How to write energy control procedures for specific machines

Last updated 2026-07-11

What does OSHA actually require for machine-specific energy control procedures?

The governing rule is 29 CFR 1910.147, OSHA's Control of Hazardous Energy standard, almost always called the lockout/tagout (LOTO) standard. ^[1] It requires employers to document procedures for controlling hazardous energy whenever a machine has more than one energy source, more than one employee performing the servicing, or any configuration where the steps to isolate energy are not obvious from a quick look.

OSHA published a letter of interpretation in 1999 clarifying that the written procedure requirement is not optional for complex machines: "The regulation clearly requires documentation for equipment that has more than one energy source." ^[2] That single sentence settles a lot of arguments about whether a given machine 'really' needs paperwork.

There is a narrow exception. If a machine has a single energy source that is readily identified and isolated, the shutdown fully de-energizes the machine, a single lockout device locks out that source, the authorized employee has exclusive control of the lock, and work does not create hazards for other employees, then no separate written procedure is required. ^[1] That exception covers very few machines in a real shop. When in doubt, write the procedure.

The standard also requires annual reviews of your energy control program and periodic inspections (at least annually) of each energy control procedure. ^[1] Those inspections must be performed by an authorized employee other than the one using the procedure, and the review must be certified in writing.

What are the required elements of a machine-specific LOTO procedure?

OSHA's 1910.147 Appendix A provides a template that lays out the minimum elements. ^[9] Every procedure must include four things:

1. A statement of the intended use of the procedure (what task triggers it) 2. Specific steps to shut down, isolate, block, and secure machines 3. Specific steps for the placement, removal, and transfer of locks 4. Requirements for testing the machine to verify effective energy control

Beyond those four categories, OSHA enforcement and the compliance directive CPL 02-00-147 treat the following as expected content even where the regulatory text doesn't spell it out word-for-word: ^[3]

• Machine identification: name, model number, and physical location
• Types and magnitude of hazardous energy (voltage, pressure in PSI, spring force, stored hydraulic pressure, chemical energy, thermal energy)
• Location and method to operate each energy-isolating device
• Type and magnitude of energy controlled by each device
• Equipment needed (lock type, hasp, blinds, blocking material, pressure gauges)
• Steps to release or restrain stored and residual energy after isolation
• Verification steps (a test to confirm zero energy state)

Here is the real-world test. A new authorized employee who knows the trade but has never touched this specific machine should be able to follow your procedure and stay safe. If it can't pass that test, it's too thin.

This table shows the required versus strongly recommended elements:

Element	Required by 1910.147	Expected by OSHA compliance directive
Machine ID and location	Yes	Yes
Energy source types and magnitude	Yes	Yes
Isolation device locations	Yes	Yes
Sequenced shutdown steps	Yes	Yes
Lock placement instructions	Yes	Yes
Stored/residual energy release steps	Yes	Yes
Verification/testing step	Yes	Yes
PPE required during LOTO	No	Yes
Number of employees covered	No	Yes
Special safety precautions	No	Yes
Photos or diagrams	No	Strongly recommended

How do you identify all energy sources on a machine before writing the procedure?

This is the part people skip, and it's where the mistakes that kill people live. OSHA estimates that proper lockout/tagout procedures would prevent roughly 120 deaths and 50,000 injuries each year. ^[4] The failures behind those numbers almost always trace back to an energy source the procedure writer missed.

Start with a physical walkdown of the machine while it's running, if you can do that safely from outside the hazard zone. Find every energy input and every place energy is stored. Work through these categories one at a time.

Electrical: Find every disconnect, circuit breaker, and plug. Some machines have more than one electrical feed, and multi-feed setups are a common surprise. Check the nameplate and electrical drawings if they exist.

Pneumatic: Locate the air supply valve and any air receivers or accumulators downstream of it. Air trapped in lines or cylinders can drive an actuator hard enough to crush a hand even after the main valve is closed.

Hydraulic: Identify the pump disconnect and every accumulator. Hydraulic accumulators hold pressure after the pump stops. They have to be bled down, more than isolated.

Mechanical/gravitational: Look for anything that can move under gravity, spring tension, or momentum. A press ram, a conveyor counterweight, a spring-loaded gate. These get blocked or restrained physically, not de-energized.

Thermal: Steam lines, heated platens, ovens, and process piping can hold dangerous heat long after power is cut. The procedure needs wait times or temperature thresholds.

Chemical: Pressurized process lines carrying reactive or hazardous materials need to be depressurized and often purged before work starts.

Document every source on a pre-procedure worksheet. Give each one a sequence number. You'll need that sequence when you write the actual steps, because the order of isolation matters. The general rule: isolate the highest-consequence source first, release stored energy last, verify zero state before anyone enters the hazard zone.

For a look at the overall program that governs these procedures, our article on lockout tagout covers the broader compliance framework.

What format should a machine-specific energy control procedure use?

OSHA does not mandate a format. The formats that actually get used in the field, and that hold up under inspection, share a few traits.

A one-page format (or one laminated card) beats a multi-page document in almost every real shop. Workers won't flip to page 3. The procedure should live at or near the machine, ideally in a weatherproof sleeve or laminated card attached to the machine itself.

The header block should capture everything at a glance: machine name and asset number, location (building/area/line), date written, date last reviewed, and who wrote it. Then a short description of the task this procedure covers, because a large machine may need different procedures for different maintenance tasks.

The body follows a numbered step format, not prose. Step 1, Step 2, Step 3. Each step is one action. "Locate the main electrical disconnect on the north side of the panel, turn to the OFF position, and apply a lock" is one step. A worker should be able to put a finger on each step as they finish it.

If the machine is visually complex, a photograph with energy sources circled and labeled is worth more than a paragraph of description. OSHA doesn't require photos, but OSHA's own training materials use them, and citations for inadequate procedures often say workers couldn't locate the energy-isolating devices from the written description alone.

The verification step goes last, always, and it should be specific. Not "test to verify de-energization" but "push the green start button, confirm motor does not start, and check hydraulic pressure gauge reads zero PSI."

What is the correct sequence of steps to write in a LOTO procedure?

The sequence OSHA describes in 1910.147(d) is the backbone your procedure steps should follow: ^[1]

1. Notify affected employees that servicing is about to begin and that equipment will be shut down. 2. If the equipment is operating, shut it down using the normal stopping procedure. 3. Operate the switch, valve, or other energy-isolating device so the equipment is isolated from its energy source. 4. Lock out and/or tag out the energy-isolating devices. 5. Release, restrain, or otherwise render safe all potentially hazardous stored or residual energy. If there is a possibility of re-accumulation, keep verifying isolation. 6. Verify the isolation before work begins.

Your machine-specific steps slot into that framework. Step 3 in the regulatory sequence, for example, might expand into six individual procedure steps if the machine has six isolation points.

The verification step (Step 6 above) is where a lot of procedures fall apart. Verification should be a positive test: push a button, try a control, read a gauge. "Assume the machine is off" is not verification. The procedure should name the specific action and the specific expected outcome.

For group lockout, where multiple authorized employees work on the same machine, add steps covering how each employee applies a personal lock to a hasp or lockout box, and the rules for who can remove their lock and when. The standard requires each employee to keep personal control of their lock throughout the servicing operation. ^[1]

How do you handle machines with multiple energy sources in one procedure?

Multiple energy sources are the norm, not the exception, in manufacturing and maintenance work. The procedure handles them by addressing each source in a defined sequence, usually a table or numbered list inside the procedure body.

For each energy-isolating device, the procedure should state: what type of energy it controls, where the device sits physically (be specific: "red valve on the south side of the machine, 18 inches above the floor"), how to operate it (turn clockwise to close, flip to the left), how to apply lockout hardware, and what the expected indicator is (pressure gauge drops to zero, pilot light goes dark).

The release of stored energy gets its own steps after all isolation devices are locked out. Pneumatic lines get bled through a drain valve. Hydraulic accumulators get cycled down. Springs may need to be blocked. These are not part of the isolation step. They happen after isolation, before verification.

One practical tip: sequence your isolation steps so the last energy source you lock out is also the last one re-energized when work is done. That minimizes the risk of a partially re-energized machine while work is wrapping up.

For machines where the energy complexity is genuinely high, some employers use a two-column format: the left column lists shutdown and lockout steps in order, the right column lists restoration steps in reverse order. It sounds fussy. It catches restoration sequence errors before they happen.

What machines are most commonly cited for missing or inadequate LOTO procedures?

Lockout/tagout has been on OSHA's top-10 most-cited standards list for over a decade. ^[5] In fiscal year 2023, it ranked as the fifth most frequently cited OSHA standard, with 2,554 violations. ^[5] Most of those fall into a handful of machine types.

Presses and stamping machines get cited most consistently, partly because they have obvious mechanical energy and partly because operators keep bypassing procedures for short die adjustments. Conveyors get cited heavily in warehousing and food processing. Woodworking equipment, especially table saws and planers, shows up often in smaller shop citations. Injection molding machines, mixers in food and chemical processing, and packaging equipment round out the list.

The citation is usually not "you have no LOTO program." More often it's 1910.147(c)(4), inadequate written procedures, because a procedure exists but doesn't address all energy sources, doesn't specify magnitudes, or has steps too vague to actually direct a worker. OSHA's compliance directive lists the inspection questions compliance officers use to judge a procedure's adequacy. ^[3]

Small businesses get caught here too. There's no small-employer pass on machine-specific procedures. The penalty structure does allow lower penalties for smaller employers and for employers with no prior history, but the citation rate for small manufacturers is substantial. Serious violation penalties in 2024 can reach $16,131 per violation. ^[6]

How do you conduct the annual procedure inspection OSHA requires?

Section 1910.147(c)(6) requires at least an annual inspection of each energy control procedure. ^[1] This is separate from the general annual review of your energy control program.

The inspection must be performed by an authorized employee other than the one who routinely uses the procedure. In a small shop, that can mean a senior maintenance tech reviews the procedure while a junior tech walks through it on the machine. The inspector certifies in writing that the inspection was done, including the machine name, the date, the names of the authorized employees who use the procedure, and the inspector's name.

The point of the inspection is to confirm the procedure is accurate, complete, and understood. It's a functional review, not a paperwork check. The inspector should actually watch an employee run the procedure or interview them through each step.

If the machine changed since the procedure was written, the inspection is where you catch it. Machines change. Energy sources get added. Pneumatic lines get rerouted. A procedure written in 2021 for a machine that got a new hydraulic cylinder in 2023 is wrong, and the annual inspection is how you find that before OSHA does.

Keep the certification records. OSHA inspectors ask for them, and employers who can produce a clean record of annual inspections consistently do better in enforcement than those who can't.

How should workers be trained on machine-specific LOTO procedures?

Training and procedures are different things, but OSHA's enforcement framework ties them together tightly. A worker who can't explain their machine's LOTO procedure during an inspection is evidence that the training requirement in 1910.147(c)(7) wasn't met, even when a written procedure exists. ^[1]

OSHA splits LOTO-affected workers into two groups: authorized employees, who actually apply locks, and affected employees, who operate the machine under normal conditions. Authorized employees need full training on energy recognition, the hazards of uncontrolled energy, the methods to control it, and the specific steps in their machine's procedures. Affected employees need enough training to understand that they cannot restart a locked-out machine.

The machine-specific procedure is the curriculum for authorized employee training. Walk each authorized employee through the procedure step by step on the actual machine, not in a classroom. Have them perform it under observation. Correct errors before you sign off on their competency.

Retraining is required when you have reason to believe the employee doesn't know the procedure, when the procedure changes, or when a supervisor notices a deviation during the annual inspection. ^[1] Keep training records: name, date, trainer, topics covered.

For context on broader OSHA training rules, the osha training article walks through the general framework, and osha 30 covers the supervisory-level training that often feeds into program oversight roles.

Are there any tools or templates that speed up writing these procedures?

Yes, several. OSHA's own 1910.147 Appendix A includes a sample energy control procedure form. ^[9] It's bare-bones, it covers every required element, and it's free. OSHA Publication 3120, "Control of Hazardous Energy," gives additional examples. ^[7]

Many industry associations publish machine-class-specific templates. The National Safety Council and other professional bodies have published LOTO resources, though access often needs membership. State-plan OSHA offices sometimes post templates; California's Cal/OSHA and Washington's WISHA have both published sample forms. ^[8]

The real bottleneck is not the template. It's the machine walkdown. No software or template can substitute for standing in front of the machine, tracing every energy input, and confirming that each isolation device is where the nameplate says it is. That work takes time. A single-source, simple machine procedure runs 20 to 30 minutes once you know what to look for. A large press with electrical, pneumatic, hydraulic, and mechanical stored energy might take two to three hours, including the verification test.

If you're building a LOTO program from scratch with multiple machines to document, batch the work: do all your machine walkdowns first, record data on a worksheet for each machine, then write procedures from the worksheets. Batching cuts writing time compared to doing each machine end-to-end.

SafetyFolio's safety program generator can produce a LOTO program framework (the required written program, procedure templates, and training record forms) in about 15 minutes. That gives you the structure so the machine walkdowns are the only work left.

For any employer also dealing with chemical hazards on these machines, the hazard communication program is a natural companion to your energy control program.

What happens if OSHA cites you for a deficient machine-specific procedure?

The most common citation under 1910.147 for inadequate written procedures is 1910.147(c)(4)(ii), which requires the procedures to clearly and specifically outline the scope, purpose, rules, and techniques for the control of hazardous energy. ^[1] OSHA usually classifies this as a serious violation, carrying a penalty up to $16,131 per instance as of 2024. ^[6]

In a citation, "per instance" can mean per machine with a deficient procedure. An employer with 12 machines, all with inadequate procedures, could theoretically face 12 separate serious violations. OSHA often groups related violations and uses gravity-based penalty adjustments, so the practical outcome varies, but the exposure is real.

Beyond the penalty, the abatement requirement will be a corrected, machine-specific written procedure for each cited machine, documented authorized employee training on the revised procedures, and often an updated annual inspection. OSHA gives you an abatement deadline, typically 30 to 90 days depending on complexity.

The informal contest process lets you negotiate penalty amounts and abatement terms. Employers who walk into the informal conference with corrected procedures already in hand and training already done almost always get a reduced penalty. Employers who show up with nothing done pay close to the full amount.

If you get cited, check whether the underlying citation triggers any obligation to file an incident report. A LOTO violation that stems from an actual injury may require OSHA 300 log entries or even immediate reporting depending on severity. The incident report article covers those thresholds.

Do LOTO procedures apply to contractors working on your equipment?

Yes. Section 1910.147(f)(2) addresses outside personnel directly: "If outside servicing personnel are to be engaged in activities covered by the scope and application of this standard, the on-site employer and the outside employer shall inform each other of their respective lockout or tagout procedures." ^[1]

In practice, before a contractor touches your equipment, you share your machine-specific procedures with them and they share their own energy control procedures with you. If the contractor's procedures conflict with yours, resolve the conflict in writing before work starts.

Your authorized employees have to know contractors are working on the equipment and must not attempt to restart or re-energize locked-out machines. This sounds obvious. Production pressure makes it less obvious in real shops.

For high-complexity contractor work, many employers require the contractor's energy control coordinator to sign off on the host employer's procedure before starting. Some require a joint pre-task walkdown. Neither is a regulatory requirement, but both are the kind of documented due diligence that protects you if something goes wrong.

Contracting also raises the question of who is the authorized employee of record when a contractor applies a lock on your equipment. The contractor is responsible for their own employees' locks. Your procedure needs to address how your employees keep awareness of the lockout state during contractor work.

Frequently asked questions

Does every machine in a facility need its own written LOTO procedure?

Not automatically. The exception in 29 CFR 1910.147(c)(4)(i) lets a single written procedure cover multiple machines if they are the same type, have the same energy sources in the same configuration, and one procedure accurately describes the steps for all of them. Any machine with unique energy sources, a unique layout, or unique stored-energy hazards needs its own document. When in doubt, write a separate one. A page of documentation is trivial next to a fatality or a $16,000 citation.

What magnitude information needs to be listed for each energy source?

OSHA expects the procedure to state the type of energy and the amount. For electrical sources, list voltage and amperage if known. For pneumatic, list line pressure in PSI. For hydraulic, list system pressure and any accumulator specifications. For thermal, note the maximum surface temperature or steam pressure. For spring or gravitational energy, a description of the hazard (for example, 'ram can fall 24 inches under gravity') is acceptable when a force measurement isn't available.

Can you use photographs instead of written steps in a LOTO procedure?

Photos can supplement written steps but can't replace them under OSHA's framework. The standard requires the procedure to 'clearly and specifically outline the scope, purpose, rules, and techniques,' which implies written language. A photo with arrows and labels is excellent for showing the location of an energy-isolating device. A photo alone can't convey the sequence of steps, the magnitude of energy, or the verification test. Use both: numbered steps plus photos where they add clarity.

Who is authorized to write a machine-specific LOTO procedure?

OSHA does not specify a credential for the person who writes the procedure. In practice, it should be written by someone who is an authorized employee under 1910.147 for that machine, meaning they've been trained on energy control methods and are qualified to apply locks. A maintenance supervisor, a senior technician, or a safety professional with direct machine knowledge is typically the right person. Having a second authorized employee review it before use catches errors.

How often do machine-specific LOTO procedures need to be updated?

OSHA requires at least an annual review and certification of each procedure under 1910.147(c)(6). Outside that annual cycle, update a procedure any time the machine is modified, relocated, or repaired in a way that changes its energy sources or isolation points. A procedure that no longer matches the machine it describes is effectively a false document, and using it is a hazardous act. Treat any capital modification to equipment as an automatic trigger for a procedure review.

What is the difference between a lockout procedure and a tagout procedure?

A lockout procedure uses a physical lock to hold an energy-isolating device in the safe position. No one can operate the device without removing the lock. A tagout procedure uses a warning tag instead of a lock, indicating the equipment must not be energized. OSHA allows tagout only when the equipment cannot physically accept a lock, and tagout provides less protection. OSHA expects employers to prefer lockout in every case where lockout is feasible.

Do machine-specific LOTO procedures apply to minor tool changes and adjustments?

The standard has a minor servicing exception at 1910.147(a)(2)(ii): routine, repetitive, and integral production adjustments may be exempt if they use alternative protection measures under a separate safe work procedure. This exception is narrow and often misapplied. It does not cover die changes on a press, blade changes on a saw, or any task where a body part could contact moving parts or stored energy. If there's any doubt, apply full LOTO. OSHA inspectors scrutinize this exception closely.

What records do you need to keep for your energy control procedures?

Keep the written procedures themselves, the annual inspection certifications (machine name, date, authorized employees' names, inspector's name), and training records for each authorized and affected employee. OSHA does not specify a retention period for LOTO records in 1910.147, but best practice is to keep them at least three years, which matches OSHA's general recordkeeping expectations. Store copies both at the machine and in a central program file.

What is the 'testing to verify de-energization' step and how specific does it need to be?

Verification means taking a positive action to confirm the machine has no residual energy before anyone enters the hazard zone. 'Positive action' means something you do and observe, not something you assume. The procedure should name the specific test: press the start button and confirm no response, read the hydraulic pressure gauge and confirm zero PSI, or use a non-contact voltage tester on the terminal block and confirm no reading. The more specific the verification step, the more defensible the procedure is under inspection.

Can one LOTO procedure cover multiple tasks on the same machine?

It depends on whether the tasks require the same isolation steps. If a conveyor needs the same electrical and pneumatic isolation for both belt replacement and roller maintenance, one procedure can cover both with a note describing which steps apply to each task. But if the tasks require different isolation points or different stored-energy release steps, separate procedures are safer and cleaner. Procedures that try to cover too many scenarios with conditional steps ('if doing Task A, skip Step 4') introduce error.

What should a group lockout procedure include that a single-employee procedure does not?

Group lockout procedures need to identify a primary authorized employee who coordinates the group, describe how each employee applies their personal lock (usually through a group lockout hasp or lockout box), specify the rules for transferring lock control during shift changes, and define the sequence for removing locks when work is complete. Every worker must keep personal control of their own lock. The procedure should also address what happens if one employee leaves before work is complete, which requires a formal lock transfer step.

How does Cal/OSHA or another state-plan OSHA differ from federal OSHA for LOTO procedures?

State-plan OSHA states must have standards at least as effective as federal OSHA, so the minimum requirements in 29 CFR 1910.147 apply everywhere. Some state plans are stricter. Cal/OSHA's lockout/tagout requirements in Title 8 CCR Section 3314 include added specificity around the verification step and certain machine types. Washington's WISHA has a similar structure. If you operate in a state-plan state, check your state's specific regulations alongside federal 1910.147. The written procedure elements are substantially the same, but penalties and enforcement emphasis can differ.

Is there a standard template for a machine-specific LOTO procedure that OSHA accepts?

OSHA's 1910.147 Appendix A provides a non-mandatory sample form covering the required elements. OSHA won't reject a procedure for using a different format as long as the content is adequate. Format matters less than content. A procedure on a laminated card with photos, written in plain language, that accurately describes every step for a specific machine will pass an inspection. A procedure on official-looking letterhead that vaguely says 'turn off all power sources' will not.

Sources

1. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (Lockout/Tagout): Full text of the lockout/tagout standard including required elements of energy control procedures, annual inspection requirements, and the minor servicing exception
2. OSHA, Standard Interpretations Letters (Lockout/Tagout): OSHA letter of interpretation clarifying that documentation is required for equipment with more than one energy source
3. OSHA, Compliance Directive CPL 02-00-147, The Control of Hazardous Energy Enforcement Policy and Inspection Procedures: OSHA enforcement guidance on what compliance officers evaluate when inspecting energy control procedures, including expected content beyond the regulatory minimum
4. OSHA, Hazardous Energy Control (Lockout/Tagout) Overview: OSHA estimate that proper lockout/tagout procedures would prevent approximately 120 deaths and 50,000 injuries each year
5. OSHA, Top 10 Most Frequently Cited Standards, Fiscal Year 2023: Lockout/tagout was the fifth most frequently cited OSHA standard in FY2023 with 2,554 violations
6. OSHA, Penalties: Serious violation penalties can reach $16,131 per violation as of 2024
7. OSHA, Control of Hazardous Energy Lockout/Tagout (OSHA Publication 3120): OSHA publication providing additional examples and guidance on writing energy control procedures
8. Cal/OSHA, Title 8 CCR Section 3314, Lockout/Tagout: California state-plan OSHA requirements for lockout/tagout, which include additional specificity beyond federal 1910.147
9. OSHA, 29 CFR 1910.147 Appendix A (Non-mandatory) - Lockout or Tagout Sample Program: OSHA's non-mandatory sample energy control program and procedure form template
10. Bureau of Labor Statistics, National Census of Fatal Occupational Injuries: BLS data on occupational fatalities supporting OSHA's injury and death estimates related to uncontrolled hazardous energy