Hazardous energy control requirements

This rule covers servicing of machinery, equipment, and systems when energization, startup, or release of hazardous energy could endanger an employee. The scope is stated in 1915.89(a)(1).

• This includes any servicing where unexpected energization or release of stored energy could harm workers.
• The general coverage is further explained in the overall 1915.89(a).

The standard applies to servicing machinery, equipment, or systems used in shipyard employment in landside facilities and on vessels or vessel sections. This application is specified in 1915.89(a)(2)(i) and its subparts for landside facilities and vessels in 1915.89(a)(2)(i)(A) and 1915.89(a)(2)(i)(B).

• The rule covers both landside work areas and on-board vessel work unless another federal agency preempts application as noted in 1915.89(a)(2)(ii).

The rule does not apply to cord-and-plug-connected equipment if the employer ensures the equipment is unplugged and the plug is under the exclusive control of the employee performing the servicing. This exception is in 1915.89(a)(4)(i).

• Exclusive control means the employee has possession of the plug (for example, in their pocket or held) to prevent reenergization while servicing.

The minor servicing exception applies to routine, repetitive, and integral tool changes and adjustments performed during normal production provided the employer ensures effective protection from energization or hazardous energy release. This is defined in 1915.89(a)(4)(ii).

• If the task is routine and protective measures (other than full lockout) provide effective protection, the written lockout procedures may not be required.
• For guidance on when temporary energization is allowed during servicing (testing/positioning), see OSHA's interpretation on the minor servicing exception in the Minor servicing exception clarification.

The employer must have a written program that includes procedures, employee protection steps, hardware specifications, training, incident investigations, and audits. These program elements are listed in 1915.89(b) and detailed in 1915.89(b)(1) through 1915.89(b)(6).

• Employers should document procedures for lockout/tags-plus, employee protection, hardware specs, training, incident investigations, and program audits.

All energy sources must be identified and isolated and the machinery, equipment, or system must be rendered inoperative before servicing begins. This requirement is in 1915.89(c)(1).

• Identification includes source, type, and magnitude of energy and any stored energy that could be released.

If an energy-isolating device can be locked, a lock must be used unless the employer demonstrates that a tags-plus system provides equivalent protection; if the device cannot be locked, a tags-plus system must be used. This is explained in 1915.89(c)(2) and 1915.89(c)(3).

• When using tags-plus where locks are possible, the employer must meet the full employee protection criteria in 1915.89(c)(6).

Each tags-plus system must include at least one energy-isolating device with a tag and at least one additional safety measure that together equal the protection offered by a lock. This is specified in 1915.89(c)(4) and its subparts 1915.89(c)(4)(i) and 1915.89(c)(4)(ii).

• The additional safety measure can be a physical barrier, removal of an isolating component, blocking, or other means that prevent reenergization or release of energy.

After October 31, 2011, energy-isolating devices must be designed to accept locks whenever machinery or systems are extensively repaired, renovated, modified, replaced, or when new machinery is installed, unless exceptions in 1915.89(c)(5) apply.

• Exceptions apply if the shipyard employer does not own the equipment or if the vessel is built or serviced to customer specifications per 1915.89(c)(5)(i) and 1915.89(c)(5)(ii).

Full employee protection requires attaching the tag where a lock would go and demonstrating that the tags-plus system provides safety equivalent to a lock by complying with tags-plus provisions and implementing any additional necessary safety measures. This is described in 1915.89(c)(6) and its subparts 1915.89(c)(6)(i) and 1915.89(c)(6)(ii).

• Employers must both follow all tags-plus provisions and add measures (e.g., additional barriers, physical removal of an isolating element) to achieve lock-equivalent protection.

Coordination is required when multiple employees are servicing multiple machines at the same time on vessels or when operations across vessels and landside areas involve the same equipment; it must include a coordinator and a log specific to each work area. This requirement is in 1915.89(c)(7)(i) and 1915.89(c)(7)(ii).

• The coordinator oversees application, verification, and removal of systems per 1915.89(c)(7)(iii).
• A continuous log must record location, type, authorized employees, and dates as listed in 1915.89(c)(7)(iv).

Written procedures must include scope and purpose, enforcement means, and step-by-step instructions for preparing shutdown, applying systems, verifying isolation, testing, removal, startup, group servicing, multi-employer worksites, and shift changes. These requirements are in 1915.89(d)(1) and its subparts 1915.89(d)(1)(i) through 1915.89(d)(1)(iii)(I).

• A single procedure may cover a group of similar machines if hazards and controls are the same (see the NOTE to 1915.89(d)(1)).

Written lockout procedures are not required when servicing involves equipment with a single, readily identifiable energy source that, when isolated and locked by one lock under exclusive control of the authorized employee, results in complete de-energization with no potential for reaccumulation and no hazard to others, and the employer has no history of related incidents. These conditions are listed in 1915.89(d)(2) and its subparts 1915.89(d)(2)(i) through 1915.89(d)(2)(viii).

• If any condition is not met (e.g., multiple energy sources, potential reaccumulation, prior incidents), a written procedure is required.

Before shutdown, the authorized employee must know the source, type, and magnitude of energization/startup hazards, hazards from hazardous energy release, and means to control those hazards, and the employer must notify each affected employee that shutdown and lockout/tags-plus will occur. This is required by 1915.89(e)(1) and its subparts 1915.89(e)(1)(i) and 1915.89(e)(1)(ii).

• Employers must also ensure shutdown follows the written procedures per 1915.89(e)(2) and be done in an orderly fashion to prevent risk per 1915.89(e)(3).

The authorized employee must relieve, disconnect, restrain, or otherwise render safe all potentially hazardous energy connected to the machinery, equipment, or system before servicing. This duty is stated in 1915.89(e)(4).

• Note: If the Navy ship's force performs shutdowns and energy rendering, the employer's authorized employee must verify the machinery is properly shut down to comply (see the NOTE to 1915.89(e)).

Only an authorized employee may apply lockout/tags-plus systems; locks must hold the energy-isolating device in a safe/off position and tags must be affixed directly to the energy-isolating device indicating removal is prohibited. These requirements are in 1915.89(f)(1), 1915.89(f)(2), and 1915.89(f)(3).

• Tags must clearly indicate that the removal of the device from a safe/off position is prohibited.

The lockout/tags-plus log must record the location and type of machinery, the name of the authorized employee applying and removing the system, and the dates the system is applied and removed. These items are specified in 1915.89(c)(7)(iv) and its subparts 1915.89(c)(7)(iv)(A) through 1915.89(c)(7)(iv)(F).

• The log must be continuous and specific to each vessel, vessel section, or landside area per 1915.89(c)(7)(ii).

Employers must provide employee information and training consistent with the program so that employees understand the procedures and their roles in lockout/tags-plus systems. This requirement appears in 1915.89(b)(4).

• Training should cover recognition of energy sources, application and removal procedures, verification of isolation, and coordination procedures where multiple employers or crews are involved.

After incidents, the employer must conduct incident investigations, and the employer must also perform periodic program audits to ensure the lockout/tags-plus program is effective. These duties are required in 1915.89(b)(5) and 1915.89(b)(6).

• Investigations should identify root causes and corrective actions; audits should review procedures, training, and field practices.

OSHA recognizes a limited, procedural alternative that allows temporary removal of lockout/tagout devices to re-energize machines for testing or positioning when necessary, but only if strict steps are followed to protect employees. This interpretation is explained in the Minor servicing exception clarification and ties to procedures in 1910.147(f)(1) (as discussed in that letter).

• Required sequence includes clearing tools/materials, removing employees from hazard areas, removing LOTO devices as specified, energizing for testing while maintaining employee protection, and then de-energizing and reapplying LOTO if further servicing is needed.
• This is a temporary allowance only for the time required to test or position equipment and does not replace lockout during other servicing phases.

When the Navy ship's force maintains control and has implemented measures it determines necessary, the employer need not provide the additional tags-plus safety measure or the tags-plus additional safety measure in those paragraphs provided the employer complies with the verification procedures in [1915.89(g)]. The notes in 1915.89(c)(4) and 1915.89(c)(6) explain this exception.

• Even when the Navy ship's force performs the control, the employer must verify isolation per 1915.89(g) (see cross-reference in the notes).

Place the tag as close as safely possible to the energy-isolating device in a safe, immediately obvious position. The standard requires this exact placement when a tag cannot be attached directly to the device (1915.89(f)(4)).

• Make the tag visible to anyone who might attempt to operate or reenergize the device.
• Ensure the tag does not create a new hazard or block safe access to controls.

Each energy-isolating device must be effective at isolating the machinery, equipment, or system from all potentially hazardous energy sources. The standard requires employers to ensure the device actually isolates the equipment from hazardous energy (1915.89(f)(5)).

• "Effective" means the device prevents transmission or release of hazardous energy (electrical, mechanical, hydraulic, pneumatic, etc.) to the work area.
• Where applicable, have an authorized employee verify the isolation before work begins (see verification procedures in 1915.89(g)).

An authorized employee—or the primary authorized employee in a group lockout—must verify that the machinery, equipment, or system is deenergized and that all energy sources are isolated before servicing. That verification step is explicitly required by 1915.89(g)(1).

• Verification should include checking isolating devices and confirming zero energy where possible (e.g., testing electrical circuits, releasing stored energy).
• Document or otherwise record verification steps per your program's procedures so there is clear evidence the verification occurred.

Yes — the authorized employee (or the primary authorized employee in a group application) must continue verifying deenergization and isolation while servicing the machinery, equipment, or system. This continuous verification requirement is in 1915.89(g)(2).

• "Continue verifying" means staying alert to any changes that could reintroduce hazardous energy and rechecking isolation points as needed.
• If service tasks change or new hazards are discovered, stop work and re-verify isolation before proceeding.

Follow the sequence in 1915.89(h): clear tools/materials, remove nonessential employees, remove lockout/tags-plus per 1915.89(i), restart and test/position, then deenergize and reapply lockout/tags-plus when finished. Those steps are set out in 1915.89(h) and its subparagraphs (h)(1)–(h)(5).

• Employers must ensure effective employee protection while the machine is energized for testing/positioning.
• OSHA guidance on temporary removal for testing (similar procedures under 1910.147) explains that employers must provide employee protection during these transition periods; see OSHA's interpretation on the minor servicing exception for related testing/repositioning guidance (https://www.osha.gov/laws-regs/standardinterpretations/2024-10-21).

Implement the steps exactly in order and promptly restore the energy control measures when testing is done.

Before removing any lockout/tags-plus system, the authorized employee must notify all other authorized and affected employees, ensure employees are safely positioned or removed, and inspect the work area to confirm nonessential items are removed and equipment components are intact. These requirements are in 1915.89(i)(1)(i)–(iii).

• Notify means a clear communication so employees know the energy control device will be removed.
• Inspecting the work area should include checking tools, guards, fasteners, and that no one is exposed to hazards when energy is restored.

Each lock or tags-plus system must be removed by the authorized employee who applied it. The standard requires removal by the person who applied the device whenever practicable (1915.89(i)(2)).

• This rule helps ensure accountability and that the person familiar with the reasons for the lock is involved in removal.
• If the original employee is unavailable, see the procedures allowed under 1915.89(i)(3).

The employer may direct another authorized employee to remove the lockout/tags-plus system only if the employer developed and included specific procedures and training that provide at least the same level of protection as removal by the original authorized employee. This allowance is in 1915.89(i)(3).

After using the alternate removal procedure the employer must, in sequence, verify the original authorized employee is not in the facility, make all reasonable efforts to contact them, and ensure they know the device was removed before work resumes (1915.89(i)(3)(i)–(iii)).

• Document the specific alternate procedures and training so you can demonstrate they provide equivalent protection.

If another authorized employee removes the lock, the employer must first verify the authorized employee who applied it is not in the facility, then make all reasonable efforts to contact that employee to inform them of the removal, and finally ensure that the original authorized employee has knowledge of the removal before work resumes. Those three sequential steps are required by 1915.89(i)(3)(i)–(iii).

• "Reasonable efforts" could include phone calls, texts, emails, or other documented attempts to reach the employee.

Before turning on machinery after servicing, the authorized employee must know the source, type, and magnitude of the hazards associated with energization or startup and the means to control those hazards. This knowledge requirement is stated in 1915.89(j)(1).

• Practical examples: know whether startup could release stored energy, create crushing points, or generate sparks, and have guards, procedures, or PPE ready to control those hazards.

Before startup, the employer must ensure tools and materials are cleared from the work area, remove nonessential employees from the work area, and start up the machinery according to the employer's detailed procedures for that equipment. These actions are required by 1915.89(j)(2) and its subparagraphs (j)(2)(i)–(iii).

• The startup must be orderly to prevent or minimize any increased hazards (1915.89(j)(2)).
• Follow your written startup procedures specific to the machine, including checks and communications before energizing.

The primary authorized employee must be assigned responsibility for the group, determine the safe exposure status of each authorized employee in the group, obtain approval from the lockout/tags-plus coordinator to apply and remove the system, and coordinate the servicing operation with the coordinator when required. These duties are laid out in 1915.89(k)(1)(i)–(iv).

• The primary authorized employee acts as the focal point for worker safety and communication for that group.

Yes — employers may either have each authorized employee apply a personal lockout/tags-plus system or use a documented procedure that provides an equivalent level of protection for each authorized employee. That flexibility is provided in 1915.89(k)(2)(i)–(ii).

• If using an alternative procedure, the employer must demonstrate it affords protection equivalent to individual personal locks.

Acceptable methods include having each authorized employee sign a group tag (or group-tag equivalent), attach a personal identification device to a group lockout device, or perform a comparable action before servicing starts, and sign off or remove their personal identification when servicing is finished. Those examples are listed in 1915.89(k)(2)(ii)(A)–(B).

• Whatever method you use must give each worker a clear, personal means of control and accountability over their protection.

The host employer must establish and implement procedures that specify responsibilities, inform each contract employer about the content of the host's lockout/tags-plus program, instruct contract employers to follow the host program, and ensure the lockout/tags-plus coordinator knows about all servicing operations and communicates with contract employers. These obligations are in 1915.89(l)(1)–(2)(iii).

• The host employer's role is to coordinate protection so all employees on site—host and contractors—are protected from hazardous energy.

Contract employers must follow the host employer's lockout/tags-plus program and procedures, ensure the host knows about the hazards related to the contract work and what the contractor is doing about them, and inform the host of any previously unidentified hazards they find. Those requirements are in 1915.89(l)(3)(i)–(iii).

• Contracts may include provisions giving contractors more control over the lockout program if that provides equivalent protection to both parties.

Employers must establish and implement specific procedures for shift or personnel changes to ensure continuity of protection and provide orderly transfer of lockout/tags-plus systems between authorized employees during shift changes or personnel changes. These requirements are in 1915.89(m)(1)–(2).

• Procedures should detail how locks/tags are transferred, how accountability is maintained, and how to prevent inadvertent energization during the handover.

The employer must provide locks and tags-plus hardware for isolating and securing machinery from hazardous energy, ensure each lock and tag is uniquely identified and not used for other purposes, and ensure each lock and tag meets requirements such as durability. These requirements are set out in 1915.89(n)(1)–(3).

• Unique identification prevents mix-ups (e.g., assign locks to individuals or equipment and mark them clearly).
• Durable materials resist weather and workplace conditions so the devices remain effective.

Locks and tags must withstand the actual workplace environment for the full duration of the servicing so they stay intact and legible. Employers must ensure "Each lock and tag is capable of withstanding the existing environmental conditions for the maximum period of time that servicing is expected to last" and "Each tag is made so that weather conditions, wet or damp conditions, corrosive substances, or other conditions in the work area where the tag is used or stored will not cause it to deteriorate or become illegible" (1915.89(n)(3)(i)(A) and 1915.89(n)(3)(i)(B)).

• Verify expected maximum exposure (time, moisture, corrosives, temperature).
• Choose locks and tags rated for those conditions (e.g., UV-resistant, corrosion-resistant materials and weatherproof printing).
• Inspect tags periodically during long jobs and replace any that become hard to read or damaged to remain compliant.

Locks and tags must be standardized in at least one visual characteristic and tags must follow a common print and format. Specifically, "Each lock and tag is standardized in at least one of the following areas: color, shape, or size; and each tag is standardized in print and format" (1915.89(n)(3)(ii) and 1915.89(n)(3)(ii)(A)–1915.89(n)(3)(ii)(B)).

• Pick at least one consistent attribute (for example: all authorized-locks are red padlocks and all tags are bright red).
• Use the same printed layout/text fields on every tag so authorized employees recognize and complete required information consistently.

"Substantial" means locks, tags, and attachments must be physically robust and hard to defeat or accidentally remove. The rule requires that each lock be strong enough to prevent removal without extra force or unusual tools, each tag and its attachment be sturdy to avoid inadvertent removal, and that tag attachments have specific design and strength characteristics (1915.89(n)(3)(iii)(A)–1915.89(n)(3)(iii)(D)).

• Locks: must resist removal without bolt cutters or other metal-cutting tools.
• Tags & attachments: must resist accidental removal; attachments should be like one-piece, all-environment nylon ties, non-reusable, self-locking, and non-releasable with a minimum unlocking strength of 50 pounds.

These requirements help ensure tags and locks remain an effective barrier and warning during servicing.

A tag must clearly warn that energizing the machinery, equipment, or system could create hazardous conditions and include a legend such as "Do Not Start," "Do Not Open," "Do Not Close," "Do Not Energize," or "Do Not Operate" (1915.89(n)(3)(v)).

• Tags should use one of the specified legends or an equivalent unambiguous warning.
• Because tags are standardized in print and format (1915.89(n)(3)(ii)(B)), ensure the legend is large and legible under your site conditions.
• Also include identity information and any other job-specific hazards per the standard so coworkers and other employees immediately grasp the risk.

Yes. Each lock and tag must indicate the identity of the authorized employee who applied it. The rule explicitly requires that "Each lock and tag indicates the identity of the authorized employee applying it" and that tags be legible and understandable to all employees (1915.89(n) and 1915.89(o)(4)(v)).

• Include the authorized employee's name (and, if you use IDs, an accompanying roster so others can verify identity).
• Make identity information permanent enough to remain readable for the duration of servicing (see environmental durability requirements in 1915.89(n)(3)(i)).

Yes — but only for the short time necessary to test or position machinery, and only if the employer follows the required sequence of protective steps and provides effective employee protection during that energized interval. OSHA allows temporary removal of lockout/tagout devices to reenergize equipment for specific testing or positioning tasks, provided the employer clears tools and materials, removes employees from the hazard area, removes LOTO devices as specified, energizes with effective protections during testing/positioning, and then de-energizes and reapplies energy control devices if further servicing is needed ([1915.89] - general lockout/tags-plus requirements; see guidance in OSHA's interpretation of 29 CFR 1910.147)(https://www.osha.gov/laws-regs/standardinterpretations/2024-10-21)).

• Follow the required sequence from 1910.147(f)(1) as explained in OSHA's interpretation: clear tools, remove employees from the danger area, remove lockout/tagout devices per procedure, provide guarding or other protection during testing/positioning, then de-energize and reapply controls if work continues (OSHA LOTO interpretation).
• This exception is limited in time and purpose — it does not substitute for lockout/tagout during the remainder of servicing.

Employees who are, or may be, in areas where lockout/tags-plus systems are used must be trained on the program purpose and function, the unique identity and standardization of locks and tags, the tags-plus system components, and prohibitions against tampering or reenergizing equipment under a lockout/tags-plus system (1915.89(o)(2)).

Key training items required by 1915.89(o)(2)(i)–(v) include:

• Purpose and function of the employer's lockout/tags-plus program.
• The unique identity and standardized color/shape/size of the locks and tags used.
• The basic components of the tags-plus system (an energy-isolating device with a tag and an additional safety measure).
• The prohibition against tampering with or removing any lockout/tags-plus system.
• The prohibition against restarting or reenergizing machinery being serviced under the system.

Affected employees must be trained not to apply or remove lockout/tags-plus systems and not to bypass or defeat them, while authorized employees and coordinators require additional hands‑on and procedural training specific to safe application, energy types, isolation methods, and documentation. These requirements are spelled out in 1915.89(o)(3) and 1915.89(o)(4)–(o)(5).

• Affected employees: do not apply/remove LOTO and do not bypass/ignore systems (1915.89(o)(3)(ii–iii)).
• Authorized employees: must know steps for safe application/use/removal, types and magnitudes of energy present, methods for isolation and control, and how to determine the safe exposure status of other employees when serving as a group's primary authorized employee (1915.89(o)(4)(i)–(iv)).
• Coordinators: must also know how to identify/isolate equipment being serviced and how to document and maintain the lockout/tags-plus log (1915.89(o)(5)(i–ii)).

Employers must retrain employees whenever job changes, equipment changes, program changes, loss of proficiency, or audit/incident findings indicate deficiencies, and must keep training records until replaced by updated records for that training type (1915.89(o)(6)(i–iii) and 1915.89(o)(7)).

• Triggers for retraining include: new job assignment hazards, new machinery or energy hazards, changes to the program or procedures, or evidence from audits/incidents of inadequate knowledge or performance (1915.89(o)(6)(i)–(ii)).
• Record retention: training records must be kept "Until replaced by updated records for each type of training" as listed in the retention table (1915.89(r)(1)(ii)).

Maintain clear records (employee name, date, subject) as required so you can show training is current.

The employer must promptly (within 24 hours) begin an investigation of any incident that resulted in or could reasonably have resulted in energization/startup or hazardous-energy release during servicing, prepare a written report containing specific elements, review the report with relevant employees, and complete corrective actions within 30 days or document an abatement plan if infeasible (1915.89(p)(1)–(4)).

Required actions and report content:

• Initiate the investigation promptly but not later than 24 hours after the incident and notify employees who were or could have been affected (1915.89(p)(2)).
• Ensure the investigation includes at least one person knowledgeable about the lockout/tags-plus program and incident analysis (1915.89(p)(3)).
• The written report must include date/time of incident and investigation start, location, description, contributing factors, current lockout/tags-plus log copy, and corrective actions (1915.89(p)(4)(i)–(vii)).
• Complete investigation and corrective actions within 30 days or prepare a written abatement plan explaining delays and interim protections (1915.89(p)(6)–(7)).

Employers must audit the lockout/tags-plus program at least annually; audits must be performed by an authorized employee not using the procedure being reviewed or by knowledgeable individuals, and must review written procedures, logs, incident reports, verify log accuracy, and include discussions with employees. A written audit report is required within 15 days of the audit (1915.89(q)(1)–(3)).

Audit requirements:

• Frequency: at least once per year (1915.89(q)(1)).
• Who: an authorized employee other than the one(s) using the reviewed procedure, or other knowledgeable individuals (1915.89(q)(2)(i–ii)).
• Content: review of written program/procedures, current log and verification of its accuracy, review of incident reports since last audit, and discussions with authorized and affected employees (1915.89(q)(3)(i)–(vi)).
• Report: prepare and deliver a written audit report within 15 days that lists findings, recommended corrections, the auditor identity, and corrective actions taken (1915.89(q)(4)(i)–(vi)).