Ansi+asse Z244.1 2016

ANSI/ASSE Z244.
1 – 2016
American National Standard
ANSI/ASSE Z244.1 – 2016

The Control of Hazardous Energy
Lockout, Tagout and Alternative Methods
ANSI/ASSE Z244.1 – 2016
4Casselogo-1200dpi_vector-1c-outline.pdf 1 1/20/2012 1:31:55 PM
American Society of
Safety Engineers
Licensed to Humberto Percca Ragas. ANSI store order # X_666199. Downloaded 07/30/2020. Single user license only. Copying and networking prohibited.
The information and materials contained in this publication have been developed from sources believed to
be reliable. However, the American Society of Safety Engineers (ASSE) as secretariat of the ANSI
accredited Z244 committee or individual committee members accept no legal responsibility for the
correctness or completeness of this material or its application to specific factual situations. By publication
of this standard, ASSE or the Z244 committee does not ensure that adherence to these recommendations
will protect the safety or health of any persons or preserve property.
ANSI®
ANSI/ASSE Z244.1 – 2016
American National Standard
The Control of Hazardous Energy

Lockout, Tagout and Alternative Methods
Secretariat
American Society of Safety Engineers

520 N. Northwest Hwy
Park Ridge, IL 60068 (847) 699-2929
Approved October 13, 2016
American National Standards Institute, Inc.
Approval of an American National Standard requires verification by ANSI that the
American requirements for due process, consensus and other criteria for approval have
National been met by the standards developer. Consensus is established when, in the
judgment of the ANSI Board of Standards Review, substantial agreement has
Standard been reached by directly and materially affected interests. Substantial agreement
means much more than a simple majority, but not necessarily unanimity.
Consensus requires that all views and objections be considered, and that a
concerted effort be made toward their resolution. The use of American National
Standards is completely voluntary; their existence does not in any respect
preclude anyone, whether he/she has approved the standards or not, from
manufacturing, marketing, purchasing, or using products, processes, or
procedures not conforming to the standards. The American National Standards
Institute does not develop standards and will in no circumstance give an
interpretation of any American National Standard. Moreover, no person shall
have the right or authority to issue an interpretation of an American National
Standard in the name of the American National Standards Institute. Requests for
interpretation should be addressed to the secretariat or sponsor whose name
appears on the title page of this standard.
Caution Notice: This American National Standard may be revised or

withdrawn at any time. The procedures of the American National Standards
Institute require that action be taken periodically to reaffirm, revise or
withdraw this standard. Purchasers of American National Standards may
receive current information on all standards by calling or writing the
American National Standards Institute.
Published December 2016 by

520 N. Northwest Hwy
Park Ridge, IL 60068
(847) 699-2929 • www.asse.org
Copyright ©2016 by American Society of Safety Engineers

All Rights Reserved.
No part of this publication may be reproduced

in any form, in an electronic retrieval system or
otherwise, without the prior written permission
of the publisher.
Printed in the United States of America
Foreword
(This Foreword is not a part of American National Standard Z244.1-2016.)
History
In March 1973, the Accredited Standards Committee Z244 held its first organizational meeting
in New York to develop a standard on lockout/tagout. The National Safety Council functioned as
the initial secretariat and provided a draft document "Guidelines for a Lockout Program" dated
November 1971 that was used as a reference for the committee’s deliberations. By the end of
1975, the standard work was complete and public review and balloting was finished. However,
various administrative and procedural problems precluded the standard from being officially
released. In March 1982, the American National Standard for Personnel Protection -
Lockout/Tagout of Energy Sources - Minimum Safety Requirements Z244.1 was finally
approved and published.
In 1987, the standard was re-affirmed without any changes in content. In April 1988, the
Occupational Safety and Health Administration (OSHA) released a proposed rule "The Control
of Hazardous Energy Sources (Lockout/Tagout)" 29 CFR1910.147 which used ANSI Z244.1 as
a principal reference source. The committee believed no consequential action should be taken
on the Z244.1 standard while federal rulemaking was underway. In September 1989, OSHA
promulgated its final rule 29 CFR1910.147, "The Control of Hazardous Energy Sources
(lockout/tagout)." Again in 1992, the ANSI standard was reaffirmed without change.
During 1997, the committee was reconstituted and voted to revise the existing 1982 standard
after over 20 years without change. Consequential meetings began in 1998 and the revision
process began with writing task groups being formed and continued through 2003. The
American Society of Safety Engineers became the secretariat of the Z244 Lockout/Tagout
committee in 2003. The title of the standard was modified to recognize the broader universe of
hazardous energy control. The standard more effectively addressed the need for greater
flexibility through the use of alternative methods based on risk assessment and application of
the hazard control hierarchy. In addition, the standard emphasized management’s responsibility
for protection of personnel against the release of hazardous energy.
The standard was processed and approved for submittal to ANSI by the Accredited Standards
Committee (Z244) on Control of Hazardous Energy, Lockout/Tagout and Alternative Methods.
The standard was approved by ANSI on July 29, 2003 with a publication date of April 14, 2004.
The Z244 committee and ANSI reaffirmed the standard without technical change in 2008 and
again in 2014 with the stipulation that the ASC (Z244) committee begin meeting to revise the
Z244 standard since no changes had been made since 2003. The ASC (Z244) committee
agreed and began the revision process in July 2014.
Need for a Standard
A wealth of casualty data exists in the private, public and governmental sectors related to the
unexpected release of hazardous energy. In fact, the issue is of global concern since all of the
major industrialized countries of the world are actively addressing the problem in various ways.
The U.S. Occupational Safety and Health Administration provided persuasive injury data in its
justification for a lockout/tagout standard for general industry in 1989.
In spite of substantial efforts by employers, unions, trade associations and government during
the past 50 years, the annual toll of injury and death related to hazardous energy release
incidents remains unacceptable. We now know that all forms of energy must be addressed; that
operational personnel are injured as often as maintenance workers; that often thermal and
gravitational forces and trapped materials under pressure are overlooked; that complex
equipment and processes frequently demand unique approaches to energy isolation or control;
and that employers need to commit resources and substantial effort in planning, training,
procedure development and infrastructure before lockout/tagout application ever occurs.
The rapid growth of technology continues to require different methods and techniques for
safeguarding workers from the unexpected release of hazardous energy. Each business sector
is actively changing the way traditional work is done, which then requires employers to develop
new equally effective responses for hazardous energy control. Protective standards need to be
improved continually to provide guidance for current conditions as well as evolving technical
developments. Advanced control systems provide new opportunities for addressing energy
control where conventional lockout is not feasible, where energy is required to perform a task,
where repetitive cycling of an energy-isolating device increases risk, and where energy is
required to maintain equipment in a safe state, etc.
Standard Perspective
The content of this standard was approached from a business and industry perspective.
However, the principles, methods and guidance are applicable to a variety of other settings and
circumstances where unexpected release of hazardous energy can occur. The procedures,
techniques, methods and design guidance contained in this standard are recommended for use
by all those whose activities fall within its scope and purpose.
The standard recognizes that zero risk is only a theoretical possibility, but is not an operative
reality - zero risk does not exist. The concept of feasible risk reduction to achieve acceptable or
tolerable risk is emphasized whether using conventional lockout, tagout or alternative methods.
With regard to hazardous energy control the term “safe” suggests the absence of risk. More
accurately, “safe” should be viewed as the acceptability of risk to those who may be exposed.
There are numerous terms that reflect the circumstances under which servicing and
maintenance is done routinely today. Terms such as AFARP (as far as reasonably practical),
ALARA (as low as reasonably achievable), or ALARP (as low as reasonably practicable) convey
a more realistic approach to risk reduction and in particular the use of alternative methods.
The standards committee and the secretariat have made a concerted effort to produce a
standard that represents the best practice regarding the control of hazardous energy. All
circumstances or situations where personnel are exposed to unexpected energy release may
not have been anticipated and adequately addressed with respect to the standard’s content.
New developments are to be expected, and revisions of the standard will be necessary as the
state of the art progresses and further experience is gained. However, uniform requirements are
needed and the standard in its present form provides performance requirements that are
necessary when developing and implementing a system for protecting personnel from
unexpected hazardous energy.
Current Status
The committee held its first meeting in July 2014 for purposes of revision of the Z244 standard
with an expanded membership. Several meetings were held to update the standard to include
current best practices and technology learned over the past 40 years of controlling hazardous
energy. Interest in participating on the Z244.1 revision committee was high and from diverse
industries, reflecting the impacts that lockout/tagout has on companies.
With the increased use of risk assessment and advancing technologies, there are now
conflicting views on the requirements for how and when to control hazardous energy. The
current requirements for the control of hazardous energy appear in 29 CFR 1910.147 under
OSHA, and in this American National Standard ANSI/ASSE Z244.1. A thorough discussion of
the similarities and differences between OSHA 29 CFR 1910.147 and the ANSI/ASSE Z244.1
standard can be found in other documents (see Bibliography).
ANSI procedures require that a standard be revised or reapproved every five years or the
standard is subject to being withdrawn after a complete ten-year cycle following approval. As
technology advances, better alternative methods can be developed to keep employees from
harm. If the static standard is followed, the employees may be exposed to greater risks than if
more current standards or technology is used as alternative methods of protection.
There is no disagreement on the basic principle that workers should be protected from the
unexpected startup or release of hazardous energy. There continues to be disagreements over
how, when and which requirements apply. The committee concentrated on how to control
hazardous energy using methods based on current knowledge. The committee discussions
focused on what was the right thing to do given current technology and industry best practices
to protect workers from harm due to the unexpected release of hazardous energy.
This revised standard presents distinct requirements for controlling hazardous energy through
three different approaches: lockout (the primary approach), tagout and alternative methods.
Alternative methods and risk assessment have received additional attention to emphasize their
importance in the energy control process. The revision better clarifies the necessary elements
for a policy, program and procedures for controlling hazardous energy. The intent of the
committee has been to write a standard that enables readers to effectively control hazardous
energy based on current knowledge.
The Service and Maintenance Construct
With the 2016 revision, the committee has rejected the normal production operations versus
service and maintenance construct as an artificial distinction without real world application. More
specifically, the committee realized that work gets done based upon the tasks to be performed
without regard to a characterization of whether the task is normal production operations, service
or maintenance. Hazards associated with the unexpected release of hazardous energy need to
be addressed – regardless of any labels or characterization attached to it.
Alternative Methods
The committee developed updated requirements for alternative methods for hazardous energy
control. New requirements were written and new guidance was provided to assist readers to
determine when lockout is required and when an alternative method may be used. Text was
also developed that describes the parameters for what constitutes an acceptable alternative
method.
The committee believes the new ANSI/ASSE Z244.1-2016 provides greater clarity and direction
to companies seeking to control the release of hazardous energy. In particular, better guidance
is provided for if, when and how alternative methods may be used to provide effective
protection. These improvements should enable companies to use modern technology and
innovative solutions to improve the safety and productivity of operations in the workplace.
Standard Guidance
Conformance language in the standard consists of the words “shall” and “should.” In this
standard the word “shall” is intended to be prescriptive, specifying mandatory requirements for
compliance with the standard. The word “should” specifies non-mandatory recommendations
and good practices that have been found to be helpful. “May” is used to indicate that something
is permitted, while “can” is used to indicate that something is possible or as a statement of fact.
The notation forward slash (/) is intended to mean and/or when used in the standard. It indicates
that two words or expressions are to be taken together or individually.
Normative Requirements
This standard uses the single column format common to many international standards. The
normative requirements appear aligned to the left margin. To meet the requirements of this
standard, machinery, equipment and process suppliers and users must conform to these
normative requirements. These requirements typically use the verb “shall.”
NOTE: The informative or explanatory notes in this standard appear indented, in italics, in
a reduced font size, which is an effort to provide a visual signal to the reader that this is
informative note, not normative text, and is not to be considered part of the requirements of
this standard; this text is advisory in nature only. The suppliers and users are not required
to conform to the informative note. The informative note is presented in this manner in an
attempt to enhance readability and to provide explanation or guidance to the sections they
follow.
Annexes
Annex materials are provided to assist the user in applying the language of the standard and
serve as guidance for implementation. They are not mandatory but are offered as relevant
examples or references to facilitate improved use.
Suggestions for Improvements
Suggestions for improvements to this standard are welcome. They should be sent to: American
Society of Safety Engineers, 520 N. Northwest Highway, Park Ridge, IL 60068 Attention: Z244
Secretariat.
Revisions: The Z244 committee welcomes proposals for revisions to this standard. Revisions
are made to the standard periodically (usually five years from the date of the standard) to
incorporate changes that appear necessary or desirable, as demonstrated by experience gained
from the application of the standard. Proposals should be as specific as possible, citing the
relevant clause number(s), the proposed wording and the reason for the proposal. Pertinent
documentation would enable the Z244 committee to process the changes in a more-timely
manner.
Interpretations: Upon a request in writing to the secretariat, the Z244 committee will render an
interpretation of any requirement of the standard. The request for interpretation should be clear,
citing the relevant paragraph number(s) and phrased as a request for a clarification of a specific
requirement. Oral interpretations are not provided.
No one but the Z244 committee (through the Z244 secretariat) is authorized to provide any
interpretation of this standard.
Approval: Neither the Z244 committee nor American National Standards Institute (ANSI)
approves, certifies, rates or endorses any item, construction, proprietary device or activity.
Committee Meetings: The Z244 committee meets periodically but frequently when the
standard is undergoing the revision process. Persons wishing to attend a meeting or join the
committee should contact the secretariat for information.
Standard Approval: This standard was processed and approved for submittal to ANSI by the
American National Standards Committee on Control of Hazardous Energy, Z244. Approval of
the standard does not necessarily imply (nor is it required) that all committee members voted for
its approval. At the time this standard was reaffirmed, the Z244 committee had the following
members:
Edward V. Grund, CSP, P.E., Chair
Jeff Fryman, Vice Chair
Ovidiu Munteanu, Secretary
Timothy R. Fisher, CSP, CHMM, ARM, CPEA, Assistant Secretary
Jennie Dalesandro, Administrative Technical Support
Organization Represented Name of Representative
Aluminum Association Mark Eliopulos

American Chemistry Council Paul Dobrowsky
American Foundry Society James J. Murphy, IV
Tom Slavin
American Petroleum Institute Kendall C. Crawford, P.E., CSP
American Society of Safety Engineers David Dodge, CSP, P.E.
George Karosas, CSP, P.E.
Arrowhead Systems, Inc./Busse/SJI Corporation Al Sumner, P.E.
Jeff Schuetz
Arthur J. Gallagher & Co. C. Gary Lopez, CSP
James D. Smith, CSP
Ashland, Inc. Jon Scheibe
Nate Snyder
B11 Standards, Inc. Sam Boytor
BNSF Railway Gregg W. Bourbon, CSP, ARM
Jim Weber, MS, CSP, OHST
Bridgestone Americas Tire Operations, LLC Kenji Furukawa
C&E Sales, Inc. Heinz Knackstedt, FS Eng
Steve Wright, P.E., CSP
Castell Interlocks Pierre Balson
Dan Skiba
Covestro LLC Terry L. Ketchum
Cummins Inc. Deena Ibrahim
Charles Glynn
design safety engineering, Inc. Bruce Main, P.E., CSP
Edison Electric Institute Thomas J. Taylor
Joe Cissna
FDR Safety LLC Mike Taubitz
Joe Wolfsberger
Fortress Interlocks Ltd. Henry Toal
Gleason Works, The Alan Metelsky
Goodyear Tire & Rubber Co. James W. Lane
Dan Pyanowski
Grantek Systems Integration Jeff Winter, CSP, FS Eng
Pat Brown
Grund Consulting Edward V. Grund, CSP, P.E.
Russell P. Bald
Honda North America, Inc. Jason Stover, CSP
Estelle Diaz, ASP
Institute of Electrical & Electronics Engineers Sue Vogel
International Brotherhood of Electrical Workers David Mullen
International Union, UAW Andrew Comai, MS
Intertek Group PLC Saranpal “Sunny” Rai
Allan Cose
JDF Consulting Enterprises Ltd. Jeff Fryman
Johnson & Johnson Donald Lyons
Ronny Briers
Komatsu America Corp. George Schreck
Jim Landowski
Master Lock Company, LLC Todd C. Grover
Matthew Dudgeon
NPES: The Association for Suppliers of Printing, Debbie Orf
Publishing & Converting Technologies
Nucor Corporation George Stephenson
Tim Reeves
Omron Scientific Technologies, Inc. Joseph Doran, P.E.
Pilz Automation Safety LP Douglas Sten, Ph.D., CSP, CMSE, CEA
Tim Huss, CSME
PMMI Fred Hayes
Precision Metalforming Association William Gaskin
James Barrett, Jr.
Robotic Industries Association Carole Franklin
Rockwell Automation, Inc. Roberta Nelson Shea, MEng, FS Eng
Wayne Solberg, FS Eng
Ross Controls Eric Cummings, FS Eng
Dan Henman
Safe-T-Sense Chris Gerges
Jamie Tolfree
SICK, Inc. Chris Soranno, FS Eng
Nate Gose, FS Eng
Society of Plastics Industry Dale Bartholomew
David Felinski
Tokyo Electron (TEL) Mark Fessler, FS Eng
Supika Mashiro
Toyota Motor Engineering & Manufacturing NA, Inc. Troy Uahinui
Bill Horsford
U.S. Department of Labor – OSHA Ken Stevanus
White Horse Safety, LLC Ted Sberna
Contents
Introduction ................................................................................................................................................ 13
1. Scope and Purpose.................................................................................................................................. 14
1.1 Scope ................................................................................................................................................. 14
1.2 Purpose ............................................................................................................................................. 14
1.3 Application Exceptions ...................................................................................................................... 14
2. References .............................................................................................................................................. 15
3. Definitions ............................................................................................................................................... 15
4. Responsibilities ....................................................................................................................................... 19
4.1 Suppliers............................................................................................................................................ 19
4.2 Users ................................................................................................................................................. 19
4.3 Personnel .......................................................................................................................................... 19
5. Design of Machinery/Equipment for the Control of Hazardous Energy ................................................. 19
5.1 General .............................................................................................................................................. 19
5.2 Partial Energization ........................................................................................................................... 20
5.3 Component Isolation......................................................................................................................... 20
5.4 Energy-Isolating Devices ................................................................................................................... 20
5.5 Special Tools or Devices .................................................................................................................... 21
5.6 Information for Use........................................................................................................................... 22
5.7 Stored and Residual Energy .............................................................................................................. 22
5.8 Control Integration ........................................................................................................................... 22
5.9 Restraint Devices............................................................................................................................... 23
5.10 Tamper Resistance .......................................................................................................................... 23
6. Hazardous Energy Control Program........................................................................................................ 23
6.1 General .............................................................................................................................................. 23
6.2 Methods of Hazardous Energy Control ............................................................................................. 23
6.3 Hazardous Energy Control Program.................................................................................................. 24
6.4 Communication and Training ............................................................................................................ 26
6.5 Program Review ................................................................................................................................ 27
6.6 Management of Change ................................................................................................................... 28
7. Control of Hazardous Energy .................................................................................................................. 28
7.1 General .............................................................................................................................................. 28
7.2 Hazardous Energy Control Procedures ............................................................................................. 29
7.3 Protective Hardware and Tags .......................................................................................................... 31
7.4 Energy-Isolating Device Identification .............................................................................................. 32
7.5 Hazardous Energy Isolation, De-Energization and Verification ........................................................ 33
7.6 Elements of Hazardous Energy Control ............................................................................................ 33
7.7 Provisions for Hazardous Energy Control Interruption ..................................................................... 35
7.8 Procedures for User-Directed Lockout or Tagout Device Removal .................................................. 36
7.9 Outside Service or Contractor Persons ............................................................................................. 36
7.10 Group Lockout................................................................................................................................. 37
7.11 Complex Group Lockout.................................................................................................................. 37
7.12 Shift or Personnel Changes ............................................................................................................. 38
8. Alternative Methods of Hazardous Energy Control ................................................................................ 38
8.1 Alternative Methods ......................................................................................................................... 38
8.2 Evaluating Alternative Methods ....................................................................................................... 44
8.3 Reliability/Effectiveness of Alternative Methods ............................................................................. 48
8.4 Special Applications .......................................................................................................................... 49
Annexes ....................................................................................................................................................... 51
Annex A The Risk Assessment Process........................................................................................................ 51
Annex B Remote Lockout System ............................................................................................................... 57
Annex C Sample Lockout or Tagout Program and Policy ............................................................................ 58
Annex D Sample of a Lockout or Tagout Application Inspection Form ...................................................... 65
Annex E Sample Management of Change Form ......................................................................................... 68
Annex F General Lockout or Tagout Procedure .......................................................................................... 70
Annex G Sample of a Hazardous Energy Control Procedure ...................................................................... 72
Annex H Samples of a Lockout or Tagout Placard ...................................................................................... 74
Annex I Lockout Tagout Permit ................................................................................................................... 76
Annex J Group Lockout Guidance ............................................................................................................... 78
Annex K Group Lockout or Tagout .............................................................................................................. 86
Annex L-1 Sample Alternative Methods Practicability/Justification Evaluation ......................................... 87
Annex L-2 Sample Alternative Method (Lockout) – Risk Assessment ........................................................ 89
Annex M Alternative Risk Reduction Measures in the Packaging Machinery Industry .............................. 91
Annex N Alternative Risk Reduction Measures in the Pharmaceutical Industry ........................................ 93
Annex O Alternative Risk Reduction Measures for the Plastics Industry ................................................... 94
Annex P Alternative Risk Reduction Measures for the Printing Industry ................................................... 95
Annex Q Alternative Risk Reduction Measure for Robotic Applications .................................................... 96
Annex R Alternative Risk Reduction Measures in the Steel Making Industry ............................................ 97
Annex S Application of this Standard to the Semiconductor Industry ..................................................... 100
Annex T Alternative Risk Reduction Measures involving Trapped Key Interlock Systems ....................... 104
Annex U Description of Risk Reduction Measures .................................................................................... 108
Annex V Control System Example Methodologies ................................................................................... 110
Annex W Alternative Risk Reduction Measures for Freeze Plug Applications.......................................... 117
Bibliography .............................................................................................................................................. 118
AMERICAN NATIONAL STANDARD Z244.1-2016
Introduction
This standard provides guidance regarding:
 responsibilities of the principal parties involved in hazardous energy control (clause 4);
 design issues that influence the effective application of control methodology (clause 5);
 hazardous energy control program elements necessary for employee protection (clause 6);
 communication and training requirements for involved personnel (clause 6.4);
 hazardous energy program review to ensure its effectiveness (clause 6.5);
 hazardous energy control methods (clause 7);
 alternative methods development for tasks where traditional lockout or tagout prohibits the
completion of those tasks (clause 8); and
 special applications where typical methods of hazardous energy control are inappropriate or
not practicable (clause 8.4).
The standard provides for decision-making flexibility regarding hazardous energy control
methodology. Alternative methods, when used, are based upon risk assessment and application
of the classic hazard control hierarchy (clause 8.1.2). However, lockout continues to be
emphasized as the primary hazardous energy control method.
13
AMERICAN NATIONAL STANDARD Z244.1

THE CONTROL OF HAZARDOUS ENERGY
LOCKOUT, TAGOUT AND ALTERNATIVE METHODS
1. Scope and Purpose

1.1 Scope
This standard covers machines, equipment and processes in which the unexpected
energization or start-up of the machines or equipment, release of stored energy or the actions of
persons could result in harm.
This standard establishes requirements for the control of hazardous energy associated with
machines, equipment or processes that could cause harm to personnel. The standard specifies
the use of lockout (primary method), tagout or alternative methods to control hazardous energy
associated with machines, equipment or processes that could cause harm to personnel.
This standard applies to activities such as erecting, installing, constructing, repairing, adjusting,
inspecting, unjamming, set up, testing, troubleshooting, cleaning, dismantling, servicing and
maintaining machines, equipment or processes.
NOTE: Different organizations characterize the above tasks as servicing, maintenance or
operations. Each organization should evaluate how best to control hazardous energy for
tasks that are performed.
This standard does not apply to work on cord and plug connected electric equipment for which
electricity is the single source of energy; is solely controlled by the unplugging of the equipment
from the energy source; and by the plug being under the exclusive control of the person.
This standard does not apply to hot tap operations involving transmission and distribution
systems for substances such as gas, steam, water or petroleum products when they are
performed on pressurized pipelines.
This standard does not apply to standard passenger vehicles, personal pleasure boats, private
aircraft or recreational/sport type vehicles.
1.2 Purpose
The purpose of this standard is to establish requirements that protect personnel where harm
can occur as a result of the unexpected release of hazardous energy.
This document is a performance standard and, as such, is not intended to limit or restrict the
use of other existing specific standards, procedures or regulations that meet the performance
objectives defined in this standard and provide an acceptable level of personal protection from
exposure to hazardous energy.
Deviations from the requirements of this standard shall be based on a documented risk
assessment.
1.3 Application Exceptions
The presence of an energy source alone does not by itself warrant the need for energy control.
The risk assessment process shall determine which energy sources are considered hazardous
for each task.
Energy sources that do not present a hazard, or exposure to the hazard, do not require control
of hazardous energies or alternative methods.
14
NOTE 1: An electrical shock example includes voltages with electromotive force rated at
less than 50V nominal line to line AC, or less than 30V DC to ground, and limited to 5
amperes. Energy sources that help prevent the hazardous release of energy for the
performance of a task do not require control of hazardous energies or alternative methods.
NOTE 2: An example includes a counter-balance on a press during a die change.
Certain tasks require partial (or full) energization to perform the task. Additional tasks shall not
be performed on the machine, equipment or process if partial energization is not required for
those other tasks.
NOTE: The scope of work should not be allowed to creep to include tasks that should be
performed under lockout. Certain diagnostic activities may require power, but the scope of
activities should not expand to include repair activities that can be performed without
power.
Energy control is not required for activities where power is required to perform a task and either
safe positioning of persons away from a hazard, or safeguarding is used for protection.
2. References
The following standards have been referenced in this standard. At the time of publication, the
editions indicated were valid and current. All standards are subject to revision, and parties to
agreements based on the ANSI/ASSE Z244.1 are encouraged to investigate the possibility of
applying the most recent edition of the standards indicated below.
ANSI B11.0, Safety of Machinery
ANSI B11.19, Performance Criteria for Safeguarding
ANSI B11.26, Function Safety of Equipment (Electrical/Fluid Power controls systems)-
Application of ISO 13849 General Principles for Design (pending)
ANSI/ASSE Z490.1, Criteria for Accepted Practices in Safety, Health and Environmental
Training
ANSI/ASSE Z10, Occupational Health & Safety Management Systems
ANSI Z535 Series, Safety Signs and Color Code Series
NFPA 79, Electrical Standard for Industrial Machinery
3. Definitions
3.1 Acceptable Risk
That risk for which the probability of an incident or exposure occurring and the severity of harm
or damage that could result is as low as reasonably practicable (ALARP) in the setting being
considered. For the purpose of this standard, the terms “acceptable risk” and “tolerable risk” are
considered to be synonymous.
3.2 Affected Person
A person who could be affected by the restart or shutdown of the machine, equipment or
process, or portions thereof.
3.3 Alarm
An audible or visual awareness means used to alert personnel to an impending hazard, (e.g.
start-up, motion or a failure or malfunction of a machine, equipment or process).
15
3.4 Alternative Method

A means of controlling hazardous energy (other than energy isolation) to reduce risk to an
acceptable level.
3.5 As Low As Reasonably Practicable (ALARP)
That level of risk which can be further lowered only by an increase in resource expenditure that
is disproportionate in relation to the resulting decrease in risk.
3.6 Authorized Person
A person identified and qualified by the user (employer) or supplier to perform hazardous
energy control.
3.7 Qualified Person
A person who, as a result of training and experience, understands and demonstrates
competence with the design, construction, operation or maintenance of the system and the
associated hazards. Also sometimes referred to as a competent person.
3.8 Control Reliability
The capability of the machine, equipment or process control system, the safeguarding, other
control components and related interfacing to achieve a safe state in the event of a failure within
their safety-related functions.
3.9 Control Circuit or Control System
Sensors, manual input and mode selection elements, interlocking and decision-making circuitry
and output elements provided to the operating devices or mechanisms of the machine,
equipment or process.
NOTE 1: Control circuits or systems can be hydraulic, pneumatic, electric, electronic or
electro-mechanical.
NOTE 2: A control circuit or control system is not the same as the safety related parts of a
control system.
3.10 De-Energized
Disconnected from all energy sources and not containing residual or stored energy.
3.11 Energized
Connected to an energy supply or containing residual or stored energy.
3.12 Energy-Isolating Device
A means of preventing the transmission or release of energy.
NOTE 1: An example is a manually operated switch (e.g. electrical circuit breaker, a
disconnect switch) by which the conductors of a circuit can be disconnected from all
ungrounded supply conductors and no pole can be operated independently.
NOTE 2: A device subject to single point failure (such as push buttons, selector switches,
wall switches or on/off equipment activating devices) is not an energy-isolating device.
NOTE 3: The means of preventing the transmission or release of energy can be, for
example, mechanical or electro-mechanical such as a line valve or a block (e.g., chains,
die block, pin, restraint).
NOTE 4: System isolation equipment that incorporates control lockout stations and is listed
for disconnection purposes where located on the load side of the main supply circuit
16
disconnecting means and over-current protection can be energy-isolating devices. See

NFPA 79.
3.13 Group Lockout
A procedure that provides equal protection for multiple users working on the same de-energized
system.
3.14 Guard
A physical barrier that prevents or restricts access to areas of the machine, equipment or
process where a hazard exists.
3.15 Hazardous Energy
Any electrical, mechanical, hydraulic, pneumatic, chemical, nuclear, thermal, gravity or other
energy that could cause harm to personnel.
3.16 Interlock
A device or system whereby the status of one control or mechanism allows or prevents the
operation of another.
3.17 Lockout Device
A positive means, such as a lock, for individual control that secures an energy-isolating device
in a position that prevents the energizing of a machine, equipment or process. This includes
devices such as accessories to go over valves and other isolation devices.
3.18 Lockout
The placing of a lock and tag or an identifiable lock on the energy-isolating device.
3.19 Lockbox
A container typically used in group lockout that secures all keys to locks on secured energy-
isolating devices and allows all exposed persons in the group to apply their personal lock.
3.20 Multiple Energy Sources
More than one source of energy going into a machine, equipment or process.
NOTE: This could be two electrical energy sources, electrical and pneumatic, electrical and
hydraulic or any similar combination of energy sources.
3.21 Normal Operations
The use of a machine, equipment or process to perform its intended function.
3.22 Permit System
A process that provides a systematic risk assessment; the precautions required before the work
proceeds; information for the users; and the documentation and management signoff of the risk.
3.23 Risk Assessment
An evaluation of the probability and the degree of the possible harm or damage to health due to
a hazardous situation in order to determine the risk reduction measures. See Annex A.
3.24 Risk Assessment, Task-Based
A risk assessment approach that identifies the tasks to be performed and the hazards
associated with elements of the tasks.
17
3.25 Risk Reduction Measure(s)

Any action or means used to eliminate hazards and/or reduce risks.
NOTE 1: Risk reduction measures can include:
 inherently safe design
 guards
 safeguarding devices
 complementary equipment
 awareness devices including warnings
 safe work practices/procedures
 training or other administrative controls
 personal protective equipment (PPE)
NOTE 2: This document uses the term “risk reduction measure(s)” as a synonym for the
term “protective measure(s)” due to its improved clarity of meaning and increasing
adoption/use internationally.
3.26 Safeguards
Engineered systems such as light curtains, pressure mats, area scanners, hold-to-run devices,
interlock switches, stop devices, trapped key devices, automated warning systems, barricades,
guards, warning signs and procedures.
3.27 Safety-Related Parts of the Control System (SRP/CS)
A control system, or portion thereof, that complies with applicable standards for safety of the
application.
3.28 Safety Signs
A visual awareness means in the form of a sign, label, decal, placard or other marking that
advises the observer of the nature and degree of the potential hazard(s) that can cause harm or
death.
3.29 Supplier
An entity that designs, redesigns, fabricates, modifies, integrates, assembles or supplies
machines, equipment or processes.
3.30 Tagout
A means to prevent the inadvertent re-energization of machinery or equipment using a tag
securely fastened to an energy-isolating device.
3.31 Troubleshooting
Diagnostic activities that are conducted on machines, equipment or processes that can be
energized or unguarded.
3.32 User
An entity that uses machines, equipment or processes covered by this standard and is
responsible for the personnel associated with hazardous energy control.
18
4. Responsibilities
4.1 Suppliers
Within the scope of their work activity, suppliers shall be responsible for designing, building,
integrating and installing machines, equipment or processes that comply with clause 5 so that
the user can effectively control hazardous energy during activities outlined in clause 1.1.
4.2 Users
Users shall be responsible for complying with the applicable provisions of this standard by
establishing an effective program for the protection of persons from hazardous energy during
activities listed in clause 1.1.
NOTE: A user can become a supplier if the user performs work within the definition of such
an entity (see Definitions).
Users shall determine which method(s) is most appropriate for controlling hazardous energy in
their operational environment: lockout, tagout, alternative methods or a combination of these.
The user shall obtain machines, equipment and processes that comply with clause 5.
The user shall be responsible for the upgrade of non-compliant equipment to be compliant with
clause 5.
If the user obtains components, parts of machines or assembles a number of machines into an
integrated manufacturing system, the user assumes the role of supplier and must fulfill the
requirements of clause 5. The user shall obtain equipment with energy isolation devices that
allow authorized persons to execute the hazardous energy control program outlined in clause 6.
NOTE: A single energy-isolating device that supplies multiple operations or machines,
while satisfying requirements, can create situations that encourage personnel to deviate
from fulfilling the intent of this standard. Additional local isolation devices or the
implementation of alternative methods could be necessary to eliminate these situations.
Management shall be responsible for developing, implementing and assessing the effectiveness
of the hazardous energy control system.
4.3 Personnel
All persons shall be responsible to comply with the hazardous energy control program (see
clause 6).
5. Design of Machinery/Equipment for the Control of Hazardous Energy
5.1 General
A risk assessment shall be performed during the design phase of machinery, equipment or
processes to determine the appropriate hazardous energy control methodologies so that the user
can comply with this standard. (See clause 8.1.1, Annex A and ANSI B11.0.)
NOTE 1: The machine, equipment or process should be designed so that personnel are
not exposed to hazardous energy during work activities. This may be accomplished in a
number of ways such as by positioning controls outside hazardous areas; adding controls
at appropriate locations; providing external lubrication points; or providing safeguarding.
NOTE 2: Hazardous energy control evaluation is part of an overall risk assessment
process and not a separate assessment process.
The hazardous energy control methodologies selected by the supplier shall be:
 Identification of energy that is necessary to perform a given task(s).
19
 Elimination of hazardous energy sources whenever practicable.

 Control of hazardous energy (see clause 7).
 Alternative methods (see clause 8).
The hazardous energy control methodologies selected by the supplier shall be appropriate for
the hazards and risk of a given task.
The supplier shall provide machinery, equipment and processes that meet the following design
requirements.
5.2 Partial Energization
Where the task includes a need for partial energization, the supplier shall perform a task-based
risk assessment to determine the appropriate method of machine, equipment or process
access. When it is necessary for machines, equipment or processes to remain partially
energized (e.g. in order to hold parts, save information, retain heat or provide local lighting),
alternative methods shall be provided for personnel safety. (See clause 8.)
5.3 Component Isolation
Machine, equipment or process installation shall provide for the local isolation of component
parts or component systems if they are to be serviced or maintained separately. The number
and location of energy isolation devices shall be determined by the configuration of the
machine, equipment or process and its intended application.
NOTE: Examples of local component isolation can include machines having heating
systems and other auxiliary systems that have separate sources of hazardous energy that
must be controlled.
5.4 Energy-Isolating Devices
Machines, equipment and processes shall be designed, manufactured, supplied and installed
with energy-isolating devices to enable compliance with the requirements in this clause 5.4.
Consideration shall be given to the intended use of the machine, equipment or process. Devices
shall be capable of controlling or dissipating hazardous energy, or both. The devices should be
an integral part of the machine, equipment or process.
When these devices are not integral to the machine, equipment or process, the supplier shall
include recommendations for type and location of energy-isolating devices in the installation
instructions.
5.4.1 Location
Energy-isolating devices shall be accessible and, where practicable, be conveniently located to
facilitate the application of isolating devices during necessary tasks. Energy-isolating devices
should be located outside hazardous areas and at a convenient height from an adjacent walking
area (i.e. not overhead or under machinery).
NOTE: For example, the center of the operating means of an electrical energy-isolating
device at its highest position should be located between 600 mm and 1700 mm (24 to 67
inches) above the servicing level. A permanent operating platform, readily accessible by
means of a permanent stair or ladder, may be considered the servicing level.
If unable to position or install isolating device(s) at a convenient location, measures shall be
taken to provide proper access to the devices.
NOTE: As an example, a remote lockout or a system isolation equipment rated as a unit
and listed for the purpose of isolating energy may be implemented as one such measure.
See Annex B.
20
5.4.2 Identification
All energy isolation devices shall be adequately labeled or marked to indicate their function,
unless they are located and arranged so that their purpose is evident. The identification shall
include the following:
 machine, equipment or process supplied; and
 energy type and magnitude.
The marking shall be of sufficient durability to withstand the anticipated environment.
NOTE 1: The potential for accidents may be reduced if employees are not expected to rely
on memory as to which isolating devices apply particularly in complex equipment. There is
a greater potential for error when energy-isolating devices are unlabeled or inadequately
identified.
NOTE 2: Examples of marking and labeling include attached or embossed markings and
signs such as “Main Breaker (480 V) Press 3,” “Natural Gas Shutoff (20 psi) Process Line
2”, “Drive Power Isolation (120V) Axis X Only,” “High Pressure (600 psi) Return Line."
NOTE 3: Electrical boxes may be labeled directly on the box. Valves may be labeled on the
valve body or with a suspended sign or tag. Restraints, blocks, chains or pins may be
labeled by stencil, color, tags or other methods.
NOTE 4: Another example of a marking or labeling system is a serialized identification
system, referenced in written procedures containing the required details on purpose,
machine, equipment or process supplied, energy type and magnitude.
Where conditions such as security are warranted, coded identification is acceptable.
5.4.3 Capability
Energy-isolating devices shall be capable of either being locked or otherwise secured in an
effective isolating position.
NOTE: Examples of effective isolating devices may include levers with aligning lock tabs
(holes); ballcocks with aligning lock tabs; locking covers which work only when the switch
is in the safe position; wheels with locking tabs (and position indicators); physical blocks
with aligning lock tabs.
An energy-isolating device is capable of being locked out if it has:
 a hasp or other means of attachment to which, or through which, a lockout device can be
affixed; or
 a lockable mechanism built into it.
5.4.4 Suitability
Each energy-isolating device shall be evaluated to determine its suitability for its intended
application.
NOTE: Examples can include extreme temperatures, environment (water, chemicals, dust),
corrosive materials, retention of a vertical load/position.
5.5 Special Tools or Devices
Special tools or devices (e.g., die blocks, retaining pins) shall be provided with the machine,
equipment, process or component parts when they are necessary for hazardous energy control.
21
5.6 Information for Use

5.6.1 Documentation Requirements
Suppliers shall provide documentation detailing:
 the procedures for use of energy-isolating devices provided (see clause 5.4.1);
 specific instructions for necessary tasks on any machine, equipment or process that are
required to be performed under partial energization based on the results of a risk
assessment;
 specific instructions for safely addressing such conditions as setup, changeover,
malfunctioning, jamming, misfeeding, troubleshooting or other reasonably foreseeable
interruptions of the operation;
 installation instructions intended for the installer of the machine, equipment or process that
identifies necessary energy-isolating devices; and
 instructions for releasing or controlling stored energy after isolation has been performed.
5.6.2 Warnings and Special Instructions
The supplier shall determine if warnings and special instructions are necessary for the machine,
equipment or process. Appropriate information shall be provided by the supplier in the
documentation. In addition, where the supplier determines that warnings or special instructions
are to be located in the area of the hazard on a label, placard or sign, the supplier shall so affix
or provide an appropriate label, sign or placard to the user for later installation. (See ANSI Z535
series.)
5.7 Stored and Residual Energy
When stored or residual energy has been determined to present an unacceptable risk, a means
for non-hazardous dissipation or safe restraint of the stored or residual energy shall be
incorporated into the machine, equipment or process. Devices used for the dissipation or safe
restraint of stored hazardous energy shall be designed with a means or method of verifying their
position and state.
When machinery, equipment or process run-down or coasting is determined to be an
unacceptable risk, safeguarding that protects against the hazard or prevents access should be
installed. If safeguarding is not practicable, then safe positioning of personnel shall be allowed,
but only when such position is predetermined and defined. (See also ANSI B11.19.)
NOTE: In the case of stored or residual thermal energy, warnings and/or instructions may
be provided instead of a device to dissipate or restrain the energy, if such a device is not
practical.
5.8 Control Integration
When alternative methods are used during setup, troubleshooting or other tasks requiring
energization or partial energization, risk reduction measures commensurate with the risk shall
ensure that a device or system will stop or prevent initiation of hazardous motion or release of
hazardous energy. (See clause 8.2.3 and ANSI B11.26.)
NOTE: Some methods of accomplishing this task for high level risk are:
 a hardware based, control-reliable safety interlock system; or
 safety-rated multiple-channel programmable logic controllers (PLCs), that are manufactured
specifically for safety applications, and applied per manufacturer’s instructions.
22
5.9 Restraint Devices

Physical restraint devices (e.g., pins, blanks, blocks, props or chains) that restrict hazardous
motion shall comply with applicable standards when one exists for the device and be designed,
constructed and installed to either:
 hold the full working force of the system when actuation can take place while the restraint
device is in place; or
 be interlocked to prevent actuation of hazardous energy/motion when removed from its
storage position and be designed and constructed to hold the maximum anticipated load.
The safety factor of these restraint devices shall be a minimum of 2, based on the maximum
anticipated load.
NOTE: See also ANSI B11.19.
5.10 Tamper Resistance
The tamper resistance of the control of hazardous energy shall be evaluated. Hazardous energy
control methods shall provide tamper resistance commensurate with the risk. In evaluating
tamper resistance, the motivation to defeat the hazardous energy control method should be
considered. (See also Annex H of ISO 14119.)
6. Hazardous Energy Control Program
6.1 General
The user shall implement a hazardous energy control methodology as part of its hazardous
energy control program for machinery, equipment and processes.
NOTE: A task-based risk assessment will assist in determining the appropriate hazardous
energy control methodologies to comply with this standard. (See clause 8.1.2, Annex A
and ANSI B11.0.)
The hazardous energy control methodologies selected by the user shall be one or more of the
following:
 control of hazardous energy (see clause 7);
 alternative methods (see clause 8); or
 partial energization (see clause 5.2).
The hazardous energy control methodologies selected by the user shall be appropriate for the
hazards and risk of a given task.
6.2 Methods of Hazardous Energy Control
The method of hazardous energy control selected depends on whether the task can be
performed with or without energized conditions. The primary method of control shall be lockout
unless the user can demonstrate tagout or an alternative method will provide effective protection
for personnel (see clauses 7.1 and 8). However, before adopting alternative methods of control,
the user shall ensure a risk assessment is conducted that demonstrates the adequacy of the
alternative method(s) and the effectiveness of the risk reduction measures. The risk assessment
shall be documented and be readily available.
NOTE 1: The user’s risk assessment should consider the warnings and special instructions
provided by the supplier.
NOTE 2: The term “energized conditions” also refers to thermal, radiation and gravitational
energy that is inherent and not normally dissipated.
23
6.3 Hazardous Energy Control Program

A systematic hazardous energy control program shall include the following elements to provide
effective protection of persons as applicable:
Identifying
 assigning responsibilities
 identifying the tasks
 identifying hazardous energy sources
 identifying energy-isolating devices
Operational Procedures
 documented procedures for hazardous energy control
 provisions for hazardous energy control interruption
 shift change
 procedures for user-directed lockout or tagout device removal
 outside service or contractor personnel
Implementation
 selecting and procuring protective materials and hardware
 communication and training
Program Maintenance
 monitoring/measuring
 auditing of program elements
 management of change
 recordkeeping
NOTE: A sample hazardous energy control program is shown in Annex C.
The user shall establish a written program for hazardous energy control detailing the
requirements in clauses 6.4, 6.5 and 8. The purpose of the program is to ensure that risk of
exposure to hazards will be eliminated or minimized before any authorized person performs any
activity listed in clause 1.1 on a machine, equipment or process where the unexpected
energizing, start-up or release of stored energy could occur and cause harm (see Figure 1).
24
Figure 1 – Flowchart for Controlling Hazardous Energy
25
Where the user has a task which is qualified by a risk assessment and lockout is not
practicable, either tagout or an alternative method which permits de-energization, energization
or partial energization shall be permitted and documented on the machine, equipment or
process specific procedure.
When a tagout device is used on an energy-isolating device, the tagout device shall be attached
at the same location that the lockout device would have been attached.
6.4 Communication and Training
6.4.1 Communication
Users shall be responsible for informing persons regarding the relevant provisions of the
hazardous energy control program. Users shall also be responsible for apprising appropriate
authorized persons of aspects of the hazardous energy control program such as changes in the
program, incident experience, performance data, auditing results and other pertinent details.
6.4.2 Training and Instruction
The user shall provide initial training or instruction that will ensure that all authorized and
affected persons understand the purpose and function of the hazardous energy control
program. Training or instruction shall be completed for all newly hired and reassigned personnel
before exposure to related hazardous energy sources occurs.
NOTE: Training and authorization includes temporary, certain outside contract persons and
suppliers.
Training shall be such that all authorized persons have an understanding that is appropriate for
the level of hazard exposure they encounter. The following elements are to be included in a
training program for authorized persons prior to their performing tasks which could expose them
to hazardous energy sources:
 the user’s written program;
 applicable manufacturer’s documentation, industry best practices, regulatory requirements
and input from the authorized persons;
 the type and magnitude of the hazardous energy sources in the workplace;
 the type of hazardous energy that might be encountered during tasks and the methods or
means to control and isolate that energy; and
 samples of machine, equipment or process specific procedures (including alternative
methods) and the information necessary for persons to implement the procedures
developed in clause 7.2.
The user shall document that all initial and additional training has been conducted. The
documentation shall contain each person’s name, dates of training and the training topic.
NOTE: The user should avoid exclusive use of generic training programs to ensure that
authorized persons adequately understand the user’s specific program. Documentation of
the information covered during training should be maintained.
Each affected person shall be instructed in the purpose and use of the hazardous energy
control program.
Training methods may include formal instruction (direct instructor contact), computer-based or
interactive training, simulation and practical demonstrated application.
Effort(s) shall be made to make the training understandable to all authorized persons.
NOTE: Training should consider the level of education, primary language or disabilities.
26
6.4.3 Assessment of Training

The user shall conduct an assessment of the effectiveness of the training that is conducted.
The assessment shall be done in such a way to ensure that authorized persons demonstrate:
 knowledge of the program;
 recognition and understanding of hazardous energy types; and
 use of appropriate hazardous energy control procedures.
NOTE: A method of verification of learning (e.g. test, demonstration, interactive response)
should be used to ensure comprehension
Authorized persons who do not demonstrate an adequate level of knowledge or use of
appropriate hazardous energy control procedures shall be retrained and not allowed to work on
the machine, equipment or process until an adequate level of knowledge is demonstrated.
6.4.4 Retraining
Retraining shall be provided for all authorized and affected persons whenever there is a change
in their job assignments; a change in machines, equipment or processes that present a new
hazard; or when there is a change in the hazardous energy control procedures.
Retraining shall also be conducted whenever an audit reveals, or whenever the user has other
reason to believe, that the authorized and affected persons’ knowledge of, or use of, the
hazardous energy control procedures is inadequate or inconsistent with the requirements.
Periodic refresher training should be conducted to maintain an appropriate level of awareness.
NOTE 1: Additional information on developing effective training programs can be found in
ANSI/ASSE Z490.1.
NOTE 2: Refresher training can be conducted concurrent with the periodic audit.
6.5 Program Review
The user shall periodically assess the condition and effectiveness of each of the elements of the
hazardous energy control program. The assessment shall include, as a minimum, the written
program, specific machine, equipment, process procedures, lockout or tagout hardware,
hazardous energy-isolating devices, alternative methods and communication and training.
6.5.1 Program Monitoring and Measurement
The user shall determine the frequency of monitoring and measuring of each of the hazardous
energy control program elements (see clause 6.3).
NOTE 1: Various methods may be used to determine that the program has appropriate
content, describes current conditions and is properly executed.
NOTE 2: Monitoring, measuring and assessing program elements should be included in
the program review process. A measurement system that is capable of providing
qualitative and quantitative feedback on hazardous energy control performance should be
established. Emphasis should be placed on both operational and maintenance personnel
who are directly involved in hazardous energy control application. See ANSI Z10 for
additional information.
6.5.2 Application of Specific Procedures
The user shall establish a continual auditing plan that will provide current information regarding
maintenance of application effectiveness. The user is responsible for executing the auditing plan
to verify that compliance is occurring. Auditing shall be conducted at least annually, and
documentation shall be maintained for a minimum of three years.
27
NOTE: The user should determine the frequency of monitoring and an appropriate specific
hazardous energy control procedure application sample size. The application effectiveness
audits should be random and address all shifts, days of operation, groups, non-standard
work situations and personnel. Knowledgeable persons should conduct visual observations
of authorized persons performing specific procedure application to include feedback and
documentation. See Annex D for a sample application inspection form.
6.5.3 Performance Feedback
The user shall establish a system for providing both positive and negative feedback to
appropriate persons and supervisors regarding the hazardous energy control program. Where
deficiencies are found, corrective action shall be taken and documented and appropriate
persons informed of the required improvements.
6.6 Management of Change
The user shall use a system(s) to ensure that hazardous energy control procedures and
relevant documentation are updated to reflect changes made to machinery, equipment and
processes. Changes affecting hazardous energy control shall be communicated to authorized
and affected persons before they work on machinery, equipment and processes.
NOTE: See Annex E.
7. Control of Hazardous Energy
7.1 General
Lockout or tagout shall be used to secure the energy-isolating device(s) to control hazardous
energy to the machinery, equipment or processes from the energy source. Lockout shall be the
primary method of hazardous energy control. Tagout is a less preferred method of controlling
hazardous energy. The control of hazardous energy includes isolation, de-energization and
verification, and shall take into consideration the impacts of residual energy.
Lockout is required in the following situations:
 When no risk assessment has been completed.
 When the tasks and/or hazards are unknown.
Lockout or tagout is required:
 during assembly and disassembly of the machine, equipment or process.
 when energy is not required to perform the task.
NOTE: Examples include, but are not limited to:
 distributed electrical (hazardous voltages, hazardous currents)
 stored electrical (capacitors, batteries)
 pressurized liquids (hydraulic, pumped)
 compressed gases (liquefied or pressurized)
 electromagnetic radiation (X-Ray, RF, IR, UV, lasers)
 static magnetic fields (permanent magnets)
 gravitational energy (e.g. suspended, hinged loads)
 kinetic energy (moving robots, linear drives, gears)
 thermal/cryogenic energy (hot, cold temperatures)
 chemical energy (heat of reaction, fire, explosion, toxic)
 stored mechanical energy (springs, elastic seals)
 for major repairs.
NOTE: Examples of major repairs include, but are not limited to:
28
 structural repairs
 drive train repairs
 replacing parts (excluding tooling)
 repairs of machine power transmission (electrical, mechanical, pneumatics, hydraulics)
 replacing components of a control system
7.1.1 Lockout
Under lockout, hazardous energy isolation shall be accomplished securing a lockout device(s)
of suitable construction placed on an energy-isolating device that prevents the inadvertent re-
energization of machinery or equipment. Lockout devices shall be placed by each participating
authorized person, either directly at each energy-isolating device, or as part of a managed
group lockout procedure. When installed, locking devices shall not be easily defeated.
7.1.2 Tagout
Under tagout, hazardous energy isolation shall be accomplished using tags secured to an
energy-isolating device that prevents the inadvertent re-energization of machinery or equipment.
Every participating authorized person shall either place an individual tag at each isolated source
or be named in a group tagging method (see clause 7.10).
Tags shall contain information including, but not limited to:
 name of person placing the tagout
 contact information for the authorized person
 statement not to operate the equipment
 statement not to remove the tagout device
NOTE: Tags may also include:
 date of installation
 list of tagout procedures
 reason for application
 other information
Tagout is not achieved through the sole use of tags, warnings or procedures without suitable
securing means to prevent the inadvertent re-energization of machinery, equipment or
processes.
NOTE 1: Tagout is less preferred than lockout for the following reasons:
 Tagout does not provide exclusive control (lockout usually does).
 Tags can be subject to damage.
 Tagout is more susceptible to malicious tampering.
 Tagout is more easily defeated (wire cutters can be used rather than bolt cutters).
NOTE 2: In certain regulated industries (railroad, nuclear, maritime, utilities), tagout is used
to achieve an equivalent level of lockout.
NOTE 3: In some process environments, a combination of lockout and tagout is used to
achieve hazardous energy control.
7.2 Hazardous Energy Control Procedures
An important element of the overall hazardous energy control program is the development of
procedures. Each unique machine, equipment or process shall have specific procedures
developed and documented for the control of hazardous energy during work activities. These
procedures shall be posted at or near the point of use, or otherwise readily available for
authorized persons to review and use.
29
NOTE 1: An example of a comprehensive specific machine, equipment or process

hazardous energy control procedure is shown in Annexes F and G, or an example of a
placard (graphic style procedure) is shown in Annex H. These procedures may be hard
copy and/or electronic.
Where a plant or facility has more than one similar machine, equipment or process, a single
procedure may be applied to all.
NOTE 2: For example, a printing company with six identical four-color sheet-fed printing
presses may have one procedure covering these six presses.
NOTE 3: Similar machines, equipment or processes may not be sufficiently similar to
enable the use of a single procedure.
NOTE 4: Different machines that use a common procedure, but have different energy
sources/locations of energy sources, should reference the common procedure and visually
identify each hazardous energy source.
Where a machine, equipment or process has a single energy supply that is readily identified and
able to be locally isolated with no residual energy present, written procedures shall not be
required.
In complex process systems (chemical, petroleum, nuclear, etc.), procedural approaches can
differ. Provision shall be made for the use of permit, pre-planning and checklist systems that
produce the equivalent of static machine or equipment procedures (see Annex I). Line breaking
procedures such as for piping networks shall supplement the process lockout and tagout
procedures when piping needs to be opened, disconnected or removed.
NOTE 5: The dynamic-real time preparation of process isolation, de-energization and
verification steps is normally managed by qualified persons and exhibits all of the content,
characteristics and provisions of the approaches associated with general machine and
equipment isolation, de-energization and verification. Often as checklists are developed for
various lockout or tagout tasks, they are archived for future reference.
7.2.1 Procedure Elements
The procedures shall state the specific requirements for effective isolation, de-energization and
verification of the machine, equipment or process. The procedures (see Annexes F and G) shall
 identification of the machine, equipment or process;
 listing of all required energy-isolating devices, the magnitude of each hazardous energy
source and its location;
 specific procedural steps for shutting down, isolating, blocking, securing and relieving stored
or residual hazardous energy;
 specific procedural steps for the placement of lockout devices;
 specific requirements that isolation, de-energization and verification has been accomplished;
 specific procedural steps for the removal of lockout devices; and
 a development, validation and revision date.
7.2.2 Procedure Management
The user shall develop a plan (see clause 6.6) for developing or revising procedures to address:
 new machine, equipment or process acquisition;
 changes to existing machines, equipment or processes;
 correction of identified hazardous energy control deficiencies and addition of any hazardous
energy control improvements that can be generated.
30
The user shall establish responsibilities for ensuring that procedures accurately reflect the
current requirements and are effective in controlling machine, equipment or process hazardous
energy.
Procedures shall be readily accessible to authorized persons and may be maintained via print or
electronic media or available in placard style at the machine, equipment or process.
NOTE 1: Procedures may be supplemented by checklists where machine, equipment or
process isolation, de-energization and verification sequence complexity or criticality
warrants.
NOTE 2: An inventory or index of all procedures should be available that contains the date
the procedures were developed, reviewed, validated and revised.
NOTE 3: Procedures should account for variables that force change in application
methods.
Procedures shall comply with the following requirements:
 Format. The user shall establish guidelines for consistent formatting of procedures.
 Validation. Each procedure shall be verified for its accuracy, completeness and hazardous
energy control effectiveness by a qualified person.
NOTE: Physical or functional testing to verify procedural effectiveness should be
performed.
 Approval. Each procedure shall be approved by the user’s designee before implementation.
 Document Maintenance. Periodic review of the procedures shall be conducted by the user
to ensure they are current. The date of development, revision and update of each procedure
shall be maintained.
7.3 Protective Hardware and Tags
All applicable protective hardware and tags required to effect isolation of hazardous energy shall
be provided by the user.
The protective hardware and tags shall be adequate in number and variety to execute the
control of hazardous energy effectively.
The protective hardware and tags shall be properly stored and accessible to authorized
persons.
7.3.1 Protective Hardware
The user shall provide protective hardware.
NOTE: Protective hardware includes locks, special use padlocks, multi-user lockout hasps,
valve control devices, electrical circuit breaker and fuse devices, cord and plug covers,
chain or cable cinching devices.
Personal locks shall be uniquely identified and keyed.
NOTE: Multiple locks assigned to an authorized person may use a single common key.
Personal locks shall bear permanent markings identifying the authorized person or have
attached personal identification tags that indicate the identity of the authorized person applying
the device(s).
Locks used to control hazardous energy shall not be used for any other purpose.
A system of identifiable locks may be provided for different functions.
NOTE: For example equipment group locks, out of service, contractors and skilled trades.
31
7.3.2 Protective Tags

Protective tags, including the material and securing means (e.g., cable tie, grommet,
reinforcement), shall be sufficiently durable for the application.
Protective tags shall be constructed and printed so that exposure to adverse conditions
(weather conditions, wet and damp locations, corrosive environments, etc.) will not cause the
tag to deteriorate or the message on the tag to become illegible.
Protective tags shall warn against hazardous conditions if the machine, equipment or process is
energized and shall include a warning such as one of the following: "Do Not Start.” “Do Not
Open.” “Do Not Close.” “Do Not Energize.” “Do Not Operate."
7.3.2.1 Personal Identification Tags
Personal identification tags shall be used where locks do not contain the identification of the
authorized person.
NOTE: The tag may also include information related to the date, time, nature of activity.
7.3.2.2 Isolation Tags
Isolation tags shall meet the following requirements:
 be capable of withstanding the environment to which they are exposed and shall remain
legible during the entire time the work is conducted;
 be standardized within the facility in at least one of the following criteria: color, shape, size
or specific markings. Additionally, print and format shall be standardized;
 be substantial enough to prevent inadvertent or accidental removal without the use of
excessive force or destructive techniques being applied by the use of securing means that
are of sufficient strength to prevent removal without destroying the securing means (such as
a zip or cable tie) and require the use of a tool to remove. Both the tag(s) placed and their
securing means shall withstand anticipated environmental exposures and inadvertent
contact. The securing means shall have no less than 50 lbs tensile strength.
7.4 Energy-Isolating Device Identification
Each energy isolation device shall be adequately labeled or marked to indicate their function,
unless they are located and arranged so that their purpose is evident. The identification shall
 machine, equipment or process supplied; and
 energy type and magnitude.
The marking shall be of sufficient durability to withstand the anticipated environment.
NOTE 1: The potential for accidents may be reduced if persons are not expected to rely on
memory as to which isolating devices apply particularly in complex equipment. There is a
greater potential for error when hazardous energy-isolating devices are unlabeled or
inadequately identified. Where conditions such as complexity or security are warranted,
coded identification is acceptable.
NOTE 2: Examples of marking and labeling include attached or embossed markings and
signs such as “Main Breaker (480 V) Press 3,” “Natural Gas Shutoff Process Line 2,” “Drive
Power Isolation Axis X Only,” “High Pressure (600 psi) Return Line."
NOTE 3: Electrical boxes may be labeled directly on the box. Valves may be labeled on the
valve body or with a suspended sign or tag. Restraints, blocks, chains or pins may be
labeled by stencil, color, tags or other methods.
32
NOTE 4: Another example of a marking or labeling system may involve a serialized

identification system, referenced in written procedures containing the required details on
purpose, machine or process supplied, energy type and magnitude.
Where conditions such as security are warranted, coded identification is acceptable.
7.5 Hazardous Energy Isolation, De-Energization and Verification
Only authorized persons shall perform lockout or tagout.
7.6 Elements of Hazardous Energy Control
Elements of hazardous energy control shall include the following actions and should be done in
the following sequence:
7.6.1 Preparation for Shutdown
Authorized persons shall:
 verify that the energy isolation being initiated is appropriate for the specific task to be
accomplished;
 understand the applicable isolation procedures specific to the equipment being isolated;
 acquire the necessary protective materials and hardware;
 identify the notification requirements; and
 determine related issues and assess the consequences of the shutdown.
7.6.2 Notification of Persons
Persons who could be affected by the shutdown of the machine, equipment or process shall be
notified prior to the application of the isolation devices.
NOTE: Process owners may be routinely notified in order to release their area/equipment
to service/maintenance personnel. They may also de-energize processes and apply
locks/tags before turning over the equipment to those doing the required work.
7.6.3 Machine, Equipment or Process Shutdown
The machine, equipment or process shall be de-energized or shut down using the specific
established hazardous energy control procedures.
NOTE: A specific sequence of shutdown could be necessary to avoid any additional or
increased hazard(s) to persons as a result of the machine, equipment or process
stoppage.
7.6.4 Machine, Equipment or Process Isolation
All energy-isolating devices that are needed to control the hazardous energy to the machine,
equipment or process to accomplish the required task(s) shall be determined and operated in
such a manner as to isolate the machine equipment or process from the hazardous energy
supply.
Isolating valves shall not be held in the safe position by pressure alone.
NOTE: If the pressure is reduced or lost on a pneumatic or hydraulic isolating valve, it
could fail to an unsafe state.
Blinds/blanks shall be made of an appropriate material and thickness for the intended
application.
On complex machinery, equipment and processes, where it is necessary to isolate power or
motion for a specific component while maintaining power to control systems, support utilities
and other devices and components, sectional (localized) energy-isolating devices may be used.
33
NOTE 1: Hazardous energy can exist in adjacent machinery, equipment and processes to
that being worked on. Appropriate energy isolation or other safety related steps may be
required.
NOTE 2: Task specific sectional lockout procedures can be developed for complex
machinery where only the energy sources impacting the safety of the work being
performed are required to be isolated and secured. (See clause 7.6.8.)
7.6.5 Lockout or Tagout Device Application
Each authorized person shall affix lockout or tagout device(s) to each hazardous energy-
isolating device.
Lockout devices, where used, shall be affixed in a manner that will ensure that hazardous
energy-isolating device(s) remain in a safe or off position.
Each authorized person shall be protected by their own lock or tag, or otherwise be provided
exclusive control. See clauses 7.11 and 7.12 for complex or group applications.
Tagout devices shall be affixed in such a manner as will clearly indicate that the movement of
hazardous energy-isolating devices from the safe or off position is prohibited.
The tag attachment shall be fastened at the same point at which the lock would have been
attached.
7.6.6 Energy Dissipation
Prior to starting the required task(s), stored hazardous energy shall be dissipated or controlled
in such a manner as to isolate the machine equipment or process from the reaccumulation or
release of hazardous energy.
7.6.7 Warning Sign or Placard Method
When an energy-isolating device cannot be secured by lockout or tagout, a warning or placard
shall be placed on the hazardous energy-isolating device to alert persons to not re-energize the
device.
Where a warning or placard cannot be affixed directly to the hazardous energy-isolating device,
the warning or placard shall be located as close as safely possible to the device in a position
that will be immediately obvious to anyone attempting to operate the machine, equipment or
process. In addition, a warning or placard shall be placed at the operator’s control position to
alert personnel that the machine, equipment or process is de-energized.
Warnings or placards shall meet the following requirements:
 Isolation warnings or placards, including their means of attachment, shall be capable of
withstanding the environment to which they are exposed, and shall remain legible during the
entire time the work is conducted.
 Isolation warnings or placards shall be standardized within the facility in at least one of the
following criteria: color, shape, size or specific markings. Additionally, print and format shall
be standardized.
 Isolation warnings or placards, including their means of attachment, shall be substantial
enough to prevent inadvertent or accidental removal without the use of excessive force or
destructive techniques.
7.6.8 Partial Energization
Through the addition of secondary energy-isolating devices downstream of the primary energy-
isolating devices, energy may be segmented to various components, devices, sections or
operating entities, if necessary, from an operations or safety standpoint. The user may protect
34
sections as required for operational and maintenance tasks while allowing partial operation,
cycling or indexing as required. The user shall select, install and integrate these devices
according to appropriate standards.
7.6.9 Controlling Hazardous Stored Energy
The established hazardous energy control procedure shall account for all hazardous stored,
residual or potential energy. The procedure shall provide the method for relieving,
disconnecting, restraining or otherwise controlling the residual energy.
NOTE 1: To protect persons, additional measures may be necessary to prevent
reaccumulation of hazardous energy.
NOTE 2: Not all stored energy is hazardous.
7.6.10 Verification of Isolation, Dissipation and De-Energization
Prior to starting work on machines, equipment or processes that have been locked out or
tagged out, the authorized person shall verify that isolation, dissipation and de-energization has
been accomplished.
NOTE 1: Verification may be accomplished by testing circuitry, cycling, visually inspecting
position, manually trying; monitoring movement or discharge; observing bleeds, gauges,
indicators, etc. or other available means. Use of the technique(s) with the best degree of
isolation assurance is preferred.
NOTE 2: There can be circumstances where definitive verification of hazardous energy
isolation is not possible, e.g. certain positions in piping systems. In such cases, other risk
reduction measures should be used until the situation is determined to be isolated or de-
energized.
7.6.11 Return to Service
The work area shall be inspected to ensure that:
 nonessential items have been removed;
 the machine, equipment or process is operationally intact;
 all controls are in a neutral or safe position;
 all safeguards that may have been disabled, removed or bypassed are reinstalled and
functional; and
 each person is in a safe location.
Affected persons shall be alerted before hazardous energy is restored to the machine,
equipment or process.
Each lockout or tagout device shall be removed from each hazardous energy-isolating device by
the authorized person who applied the device or by compliance with clause 7.8.
Before lockout or tagout devices have been removed, and before a machine, equipment or
process is started, affected persons shall be notified that the lockout or tagout device(s) will be
removed.
7.7 Provisions for Hazardous Energy Control Interruption
In situations in which lockout or tagout devices are temporarily removed, and the machine,
equipment or process is either fully or partially energized to test, troubleshoot, inspect or
position the machine, equipment, process or a component thereof, the sequence of actions
detailed below shall be followed:
1. Clear the machine, equipment or process of tools and materials.
35
2. Notify and clear persons from the machine, equipment or process area, or provide a safe
position for persons.
3. Remove the lockout or tagout devices.
4. Restore energy to only those functions which require energy for the task.
5. Position or inspect the machine, equipment or process.
6. Perform the task.
When the hazardous energy is no longer needed, reapply lockout or tagout.
7.8 Procedures for User-Directed Lockout or Tagout Device Removal
When the authorized person who applied the lockout or tagout device is not available to remove
it, that device may be removed under the direction of the user, provided that specific procedures
and training for such removal have been developed, documented and incorporated as a
documented process into the user’s hazardous energy control program. The user’s specific
procedure shall incorporate the requirements in clause 7.6.11 in addition to the following
elements:
 verification by the appropriate supervisory personnel of the status and condition of the
machine, equipment or process and that the authorized person who applied the device is
not available; and
 ensuring that the authorized person will be informed before they resume work at that facility
that their lockout or tagout device has been removed.
7.9 Outside Service or Contractor Persons
The host-user and outside service or contractor persons shall each designate a representative
responsible for determining their relationship, responsibilities and obligations regarding
hazardous energy control prior to the outside service or contractor starting work or providing
services.
NOTE: Outside service or contractor persons (and their sub-contractors) should be vetted
or evaluated regarding their competence related to the control of hazardous energy. A
documented agreement should clarify the details of hazardous energy control program
(e.g. work boundaries, host, contractor or hybrid system, notification, hardware, etc.).
7.9.1 Notifying of Hazard
The host-user shall inform the outside service or contractor designated representative of any
known special or unique hazards that are related to the machinery, equipment or process to
which the outside service or contractor persons could be exposed. This includes provision of
existing and specific control of hazardous energy procedures developed for the equipment in
question.
7.9.2 Program Coordination
All outside service organizations’ or contractors’ programs shall be coordinated with the host-
user’s hazardous energy control program when there is integration of job tasks. Protection for all
persons who could be exposed to hazardous energy within the facility shall be mutually
understood, communicated and agreed upon between the parties.
NOTE: The contractor’s program may be different in the form they take (i.e. practice or
hardware). In order to eliminate confusion or to clearly differentiate and standardize on
contractor-controlled lockouts, the host-user site may provide locks and tags that are
coordinated with the site lock and tag system. Communication is a key element of a
36
hazardous energy control program and a clear lock or tag identity with assigned
responsibility is important.
7.9.3 Communications
Prior to and during the course of the work, both the host-user and outside service or contractors
shall keep each other informed of any activities or conditions that may adversely affect the
application of hazardous energy control or impact the normal operation of machines, equipment
or processes.
NOTE: Examples of activities or conditions that could warrant communication between the
parties are interruption of hazardous energy supply, disabling a fire protection/security
system, emergency alarm systems, hazardous area ventilation and special equipment that
is needed for the control hazardous energies.
7.9.4 Temporary Persons
Directly supervised temporary persons required to perform lockout functions shall be trained in
the hazardous energy control program, issued necessary equipment and, depending on their
specific job responsibilities, require site authorization and possess certain qualifications to
perform specific work covered by this standard.
7.10 Group Lockout
When multiple hazardous energy-isolating devices protecting the affected work activity are
secured by lockout, but are not applied directly by each authorized person, an authorized
person shall be designated to control the hazardous energy. The group lockout shall work in
accordance with an equipment specific hazardous energy isolation and de-energization
procedure and shall be responsible for lockout of each hazardous energy-isolating device. The
group lockout shall provide a single location or device (e.g. lockbox) that allows each member of
the group to apply their personal lock. Verification shall take place before potential exposure to
hazardous energy occurs to determine the effectiveness of the hazardous energy isolation and
de-energization.
NOTE 1: Similar procedures may be used for group tagout or permit systems.
NOTE 2: See Annexes I and J.
7.11 Complex Group Lockout
When all hazardous energy-isolating devices protecting the affected work activity are secured
by lockout, but are not controlled directly by each authorized person, and more than one of the
following conditions applies:
 a significant number of hazardous energy-isolating devices or authorized persons are
involved;
 the period of hazardous energy isolation and de-energization is extended;
 the hazardous energy-isolating device(s) is relatively inaccessible or remotely located; or
 there is interdependence and interrelationship of the system components;
then management shall designate authorized persons responsible for ensuring an effective level
of personal protection for each member of the group using individual continuous accountability
methods such as work permits, control boards, etc. Verification shall take place to determine the
effectiveness of the hazardous energy isolation and de-energization.
NOTE 1: See Annexes I and J for additional group lockout or tagout guidance.
NOTE 2: With sophisticated and complex process equipment used in the petroleum, utility,
metals, paper, food and chemical industries, adaptation and modification of normal group
37
lockout or tagout procedures may be necessary to ensure the safety of the employees
performing the work.
7.12 Shift or Personnel Changes
Specific procedures shall be used during shift or personnel changes to ensure the continuity of
lockout or tagout protection, including a provision for the orderly transfer of lockout or tagout
device protection between off-going and oncoming authorized persons, to minimize exposure to
hazards from the unexpected energization or start-up of the machine, equipment or process, or
the release of hazardous stored energy.
NOTE: An example of shift or personnel changes is as follows: a service lock is applied to
each hazardous energy-isolating device when the authorized employee or contractor has
completed their shift, but the work is not completed, or when the employee or contractor
must leave the building for any reason (example: pick up parts, move to another machine,
etc.). When their personal lock is removed, a service/transition lock is applied. All
maintenance personnel have keys to the service locks, which allow them to remove these
locks and attach their personal locks to continue repair of the machine/equipment. A
service lock is not intended to replace a personal lock. The sole purpose is to maintain the
integrity of the lockout between employees or contractors. When a service lock is removed
and replaced by a personal lock, the employee is required to verify that all hazardous
energy sources remain isolated or controlled.
8. Alternative Methods of Hazardous Energy Control
8.1 Alternative Methods
Lockout or tagout shall be used unless the user can demonstrate an alternative method will
provide effective protection for persons. When lockout or tagout is not used, then alternative
methods shall be used only after the hazards have been assessed and risks documented.
Before alternative methods are used, the following shall be completed:
 a practicability/justification analysis as per clause 8.2.1
 a risk assessment as per clause 8.2.2
 other applicable evaluations as described in clauses 8.2.3 – 8.2.12
NOTE: Situations where alternative methods may apply include, but are not limited to:
 when hazardous energy is present because it is required to do the task;
 when lockout or tagout is not feasible or practicable (see Annex L for example practicability
evaluation);
 when a documented risk assessment shows the task can be performed with acceptable risk;
 when inherent hazards (e.g., thermal, radiation) are unable to be controlled using lockout or
tagout;
 when energy is required to maintain equipment in a safe state;
 when repetitive cycling of an energy isolation device compromises its safe function;
 when the operation of a standard energy isolation device creates an additional hazard.
The alternative method shall be designed by a qualified person(s).
Selection of an alternative method shall be based on a risk assessment of the machine,
equipment or process as specified in clause 8.1.1. The risk assessment shall take into
consideration that existing risk reduction measures provided with the machine, equipment or
process may need to be removed or modified to perform a given task. Risk reduction measures
such as those specified in clauses 8.1.2.1 through 8.1.2.6 shall be used following the hierarchy
in clause 8.1.2 to ensure effective protection.
NOTE: Tasks that might have to be performed using alternative methods include, but are
not limited to:
38
 die changing
 jam clearing
 make-ready
 lubrication
 tool changes
 roll polishing
 cleaning
 adjustments
 set-up
 inspection
 taking measurements
 taking samples
Placing a machine in manual mode in and of itself shall not be used as an alternative method for
lockout or tagout.
NOTE 1: Use of other risk reduction measures in conjunction with a manual mode may be
acceptable as an alternative to lockout or tagout.
NOTE 2: Examples of alternative methods of hazardous energy control are contained in
Annexes L - S.
8.1.1 Risk Assessment Process
The risk assessment process shall include a series of logical steps to examine the hazards
associated with machinery, equipment and processes systematically. There are many risk
assessment methods available. For purposes of this standard, risk assessment is usually a
qualitative estimation and does not require quantitative probabilistic analysis. The key elements
of risk assessment include the following:
 prepare for/set limits of the assessment
 identify tasks, elements of each task and hazards
 assess initial risk
 reduce risk
 assess residual risk
 achieve acceptable risk
 validate solutions
 document the process
NOTE: See also Figure 2.
39
Figure 2 – The Risk Assessment Process
40
NOTE 1: Risk assessment methods can be found in ANSI B11.0, ISO 12100, ANSI/PMMI
B155.1, ISO 14121-2, SEMI S10, ANSI/ASSE Z10 and others.
NOTE 2: This standard does not require a specific risk assessment methodology, but
includes Annex A as an example to illustrate the analytical process that may be necessary
to ensure that any alternative method(s) selected provides an acceptable level of risk to the
exposed persons.
8.1.2 Hazard Control Hierarchy
A hierarchical process shall be used in the selection of feasible risk reduction measures in the
following order of preference:
a) Eliminate the hazard through design (clause 8.1.2.1);
b) Substitution (clause 8.1.2.2);
c) Guards and safeguarding devices (clause 8.1.2.3);
d) Awareness devices (clause 8.1.2.4);
e) Procedures and training (clause 8.1.2.5); and
f) Use of personal protective equipment (clause 8.1.2.6).
When alternative methods have been determined using b) through e) above, appropriate
communication and training of persons shall be developed and provided.
NOTE 1: The objective of this process is to select the highest level of feasible risk
reduction measure(s). In many cases, application of any single control methodology is not
adequate to provide an effective level of protection for persons. It may be necessary to use
a combination of the methodologies suggested in clauses 8.1.2 b) to 8.1.2 e) to provide
persons with protection equivalent to lockout or tagout.
NOTE 2: Annexes L - S provide illustrative examples of how various industries have
employed alternative methods to provide persons with effective protection.
If the level of risk is not acceptable, risk reduction measures shall be implemented to reduce
that risk.
NOTE: Risk reduction measures are a combination of the measures taken by the supplier
and/or the user.
Risks shall be reduced using the hazard control hierarchy described in clause 8.1.2 and shown
in Table 1 below.
Risk may be reduced by:
 limiting the severity of the harm that the hazard could cause (such as by reducing the
amount of energy that could be transferred to a person);
 reducing the probability that the hazard exists (by eliminating the hazard);
 reducing the probability that exposure to the hazardous energy will occur (such as by
eliminating or reducing the need for access to the hazard); or
 reducing the probability that harm will occur if exposure occurs (such as by reducing speed
or by placing guards on energized points within an enclosure).
In selecting the most appropriate risk reduction measures, apply the following principles in the
order (clauses 8.1.2.1 through 8.1.2.6) as they appear below.
NOTE: See also Annex U.
41
Table 1 – The Hazard Control Hierarchy

Risk Reduction Influence on Risk
Examples Classification
Measures Factors
 Eliminate pinch points  Impact on overall risk
(increase clearance) (elimination) by
 Intrinsically safe affecting severity and
(energy containment) probability of harm
 Automated material  May affect severity of
Most
Elimination handling (robots, harm, frequency of
Preferred
or conveyors, etc.) exposure to the hazard Design Out
Substitution  Redesign the process under consideration,
to eliminate or reduce and/or the possibility of
human interaction avoiding or limiting
 Reduced energy harm depending on
 Substitute less which method of
hazardous chemicals substitution is applied.
 Barriers  Greatest impact on the
 Interlocks probability of harm
 Presence sensing (Occurrence of
Guards,
devices (light hazardous events Engineering
Safeguarding
curtains, safety mats, under certain Controls
Devices
area scanners, etc.) circumstance)
 Two hand control and  Minimal if any impact
two-hand trip devices on severity of harm
 Lights, beacons and  Potential impact on the
strobes probability of harm
 Computer warnings (avoidance)
Awareness Devices
 Signs and labels  No impact on severity
 Beepers, horns and of harm
sirens
 Safe work  Potential impact on the
procedures probability of harm
 Safety equipment (avoidance and/or
Training and Administrative
inspections exposure)
Procedures Controls
 Training  No impact on severity
 Lockout/Tagout/ of harm
Verify
Least  Safety glasses and  Potential impact on the
Preferred face shields probability of harm
Personal Protective
 Ear plugs (avoidance)
Equipment
 Gloves  No impact on severity
(PPE)
 Protective footwear of harm
 Respirators
NOTE: Not all potential risk reduction measures are practicable. Many factors determine if
the risk reduction measure is practicable. It is necessary to evaluate the application of the
risk reduction measure against the following factors:
 regulatory obligations
 effectiveness
 usability
 durability and maintainability
 ergonomic impact
42
 cost/economic feasibility
 introduction of new hazards
 productivity/ease of recovery
 machine performance
 technological feasibility
8.1.2.1 Eliminate the Hazard Through Design
Where practicable, hazards shall be eliminated through design. Eliminating the hazard or
reducing the risk through design provides the highest degree of risk reduction.
NOTE 1: Examples include:
 eliminate dangerous parts, conditions and events
 modify physical features (e.g., sharp edges, shear points)
 reduce energy transfer
 alter task or process
 isolation or containment
NOTE 2: Improving the design may reduce risk and waste. See ANSI B11.TR7 for
additional information.
8.1.2.2 Substitution
Where practicable, alternative materials, methods or energy levels shall be substituted to
reduce the risk of harm from hazards (e.g., substituting less toxic or hazardous materials and
substances).
8.1.2.3 Guards and Safeguarding Devices
Where practicable, guards and safeguarding devices shall be provided to detect and/or prevent/
restrict access to hazards that cannot be eliminated. See ANSI B11.19.
NOTE: Where hazards cannot be eliminated, guards and safeguarding devices and
administrative controls are usually used together to reduce risks to an acceptable level.
8.1.2.4 Awareness Devices
Awareness devices shall be used where appropriate to inform affected persons of hazards.
Awareness devices also inform users of hazards from which they are protected by guards or
barriers. See ANSI B11.19 for additional details on awareness devices.
NOTE: Awareness devices inform users of any significant residual risks which have not
been eliminated by design or reduced by guards or safeguarding devices. Awareness
devices include warnings (signs or labels), lights, alarms, awareness barriers or other
devices. Visual signals (such as flashing lights) and audible signals can be used to warn of
an impending hazardous event such as machine start-up or over-speed.
8.1.2.5 Procedures and Training
The use of guards, safeguarding devices and awareness devices can result in a residual risk.
Procedures and training shall be used to supplement existing guards, safeguarding and
awareness devices. Procedures and training may include formal or informal training, standard
operating procedures, checklists and personnel certifications.
The machine, equipment or process supplier shall provide instructions to the user of specialized
procedures and training necessary for using the machine, equipment or process.
NOTE: Procedures and training should be provided for the operation of the machine; the
application, use and adjustment of safeguarding equipment; and awareness devices.
43
8.1.2.6 Use of Personal Protective Equipment (PPE)

PPE shall be used in conjunction with, but not in lieu of, other risk reduction measures or when
other methods do not result in acceptable risk.
NOTE: PPE includes safety glasses, hearing protection, gloves, non-slip footwear, etc.
8.2 Evaluating Alternative Methods
In evaluating an alternative method to lockout or tagout, the risk reduction measures that will
comprise the alternative method shall be identified. Based on current analyses and best
practices, alternative methods shall consist of the following parameters as applicable:
 practicability/justification analysis (clause 8.2.1)
 risk assessment based on the tasks being performed (clause 8.2.2)
 industry best practices/methods (clause 8.2.3)
 architecture/structure (clause 8.2.4)
 using well-tried components (clause 8.2.5)
 using well-tried designs (clause 8.2.6)
 common cause failure (clause 8.2.7)
 fault tolerance (clause 8.2.8)
 exclusivity of control (clause 8.2.9)
 tamper resistance (clause 8.2.10)
 program to support (clause 8.2.11)
 procedures in place (clause 8.2.12)
 periodic checking and testing (clause 8.2.13)
 review by a qualified person (clause 8.2.14)
Each topic is addressed in greater detail as follows. Not all of the above parameters will
necessarily apply to a specific situation.
NOTE: When considering alternative methods, it should be understood that conventional
energy-isolating devices are also subject to failure and the user should exercise care when
subjecting them to use beyond their inherent performance capability (disconnects can arc
or experience mechanical fault, valves can leak, powered valves can experience upstream
control failures, etc.).
8.2.1 Practicability/Justification Analysis
Prior to using an alternative method, a documented practicability analysis shall be conducted to
evaluate the ability to use lockout. The analysis shall evaluate the following elements, as
applicable:
8.2.1.1 Lockout Impacts
The impact(s) of applying conventional lockout or tagout shall be evaluated.
NOTE: Aspects may include task interference, power needed for task, electrical device
wear, increased risk to persons/process if used.
8.2.1.2 Minimizing Exposure
Options for avoiding using power or minimizing the use of energy shall be evaluated.
NOTE: Aspects may include modifying the task, completing the task remotely, product or
process changes.
44
8.2.1.3 Practicability
Obstacles which prevent using the primary means of hazardous energy control (lockout) shall
be evaluated.
NOTE: Aspects may include evidence (historical or from testing) of practicability, need for
power, inherent hazards. See Annex L.
8.2.1.4 Potential Alternative Method(s)
Potential alternative method(s) that may be suitable to the situation shall be evaluated.
NOTE: Aspects may include electronically interlocked access, trapped key system, remote
lockout, monitored power systems.
In some situations, lockout or tagout may be feasible, but an alternate method may offer a safer
and more effective solution than lockout or tagout. In those situations, the alternate method shall
be designed and installed according to the requirements of clauses 8.2.2 – 8.2.14.
The practicability/justification analysis results in a “go/no go” decision as to lockout practicability.
If the results of the practicability/justification analysis demonstrate that lockout is a viable option,
then lockout shall be used. If the results indicate that lockout is not feasible and an alternative
method is suitable for the application, then further analyses shall be conducted as described in
clauses 8.2.2 – 8.2.14.
8.2.2 Risk Assessment
An alternative method to lockout or tagout shall be based on a risk assessment that identifies
the hazards associated with the tasks to be performed (see also clause 8.1.1).
NOTE: The critical part of the risk assessment is to make certain that the hazards and
failure modes are known prior to using the alternative method. For example, routine or
repetitive tasks usually involve hazards that are well known. Non-routine or unique tasks
can involve hazards or failure modes that are not well known. A risk assessment should be
performed to be certain that the tasks and hazards are identified, understood and
addressed to reduce the risks to an acceptable level.
8.2.3 Industry Best Practices/Methods
Alternative methods shall be evaluated for the use of applicable industry best practices/
methods. Industry best practices/methods shall be used in alternative methods where
applicable.
NOTE: Industry best practices/methods represent an industry prevailing way of controlling
hazardous energy (e.g., molten aluminum casting explosion control; roof bolting in
underground mining).
8.2.4 Architecture/Structure
The architecture/structure used as part of an alternative method shall be evaluated. The
architecture/structure of the alternative method shall be commensurate with the risk.
NOTE: A key consideration in evaluating the safety performance (reliability) of the
alternative method involves the architecture or structure of the system. If components are
used that are less than well-tried, or if less than well-tried designs are implemented, the
architecture/structure can greatly improve the system reliability.
As the risk increases, the architecture/structure requirements shall also increase (from single
elements to redundancy, monitoring and self-checking). The higher the risk of harm, the more
robust the architecture/structure required.
45
8.2.5 Well-Tried Components

Components used as part of an alternative method shall be evaluated. An alternative method
should use well-tried industrial rated components.
NOTE 1: A well-tried component is a component that is either widely used in the past with
successful results in similar applications, or made and verified by the component
manufacturer using principles which demonstrate its suitability and reliability for safety-
related applications.
NOTE 2: The components used can be checked and verified on new machinery and
equipment, but also on existing equipment in use in the field. Thus both users and
suppliers of machinery can verify the design on existing machinery in the field.
8.2.6 Well-Tried Designs
The design used as part of an alternative method shall be evaluated. Alternative methods
should use well-tried designs.
NOTE 1: A well-tried design is a system that has been demonstrated, based on an analysis
of operational experience for a specific configuration of an element, to show that the
likelihood of dangerous systematic faults is acceptably low.
NOTE 2: See also ANSI/ASSE Z590.3.
8.2.7 Common Cause Failure (CCF)
An alternative method shall be evaluated for susceptibility for common cause failures.
NOTE 1: Common cause failures refers to a failure, which is the result of one or more
events, causing concurrent failures of two or more separate elements in a redundant
architecture/structure subsystem, leading to a dangerous failure.
NOTE 2: A CCF usually results in two or more failures from a single event or cause. The
design should be assessed to establish the effectiveness of the measures used to
safeguard against CCF.
8.2.8 Fault Tolerance
The fault tolerance of an alternative method shall be evaluated. The alternative method shall
tolerate faults occurring at a level that is commensurate with the risk.
NOTE 1: Fault tolerance pertains to the ability of an alternative method to achieve a safe
state in the event of a fault. Faults can include leaking valves, electrical shorts, contactors
welding shut, mechanical fractures/breakage, overheating components, environmental
exposure.
NOTE 2: Fault tolerance is determined by the architecture of the circuit and generally
defined as categories and performance levels in ISO 13849-1 or “Control Reliability” as
defined in ANSI B11.19. See Annex V.
8.2.9 Exclusivity/Individual Control
The exclusivity/individual control of an alternative method shall be evaluated. Each person
performing a task shall be protected from unexpected release of hazardous energy initiated by
others. Alternative methods shall provide a level of exclusive control that is appropriate to the
level of risk and the hazardous situation.
NOTE 1: Examples include, but are not limited to:
 locks
 size of working zone
 proximity to control stations, pendants or devices
46
 locking devices
 passwords
 enabling devices
 hold to run controls
 trapped key systems (see Annex T)
 presence sensing devices (under some conditions)
 interlock blocking device
 RFID systems
See ANSI B11.19 for additional information.
Factors that reduce exclusivity shall be considered in the use of alternate risk reduction measures.
NOTE 2: Examples include, but are not limited to:
 key reproducibility
 manual manipulation of controls or devices
 password protection and management
 visibility of the hazardous area from the reset location (line of sight)
8.2.10 Tamper Resistance
The tamper resistance of an alternative method shall be evaluated. Alternative methods shall
provide tamper resistance commensurate with the risk. In evaluating tamper resistance, the
motivation to defeat the alternative method should be considered. See also Annex H of ISO
14119.
NOTE 1: Whereas exclusivity pertains to the ability of a person to control the release of
energy, tamper resistance refers to the ability of a person to intentionally tamper, resulting
in a system inadvertently energizing or releasing energy. A lock exhibits good tamper
resistance due to the physical properties of the lock. Tagout has less tamper resistance as
defeating a plastic zip tie requires less force and tools that are more easily obtained (for
example pliers versus bolt cutters). A warning or tag exhibits even less tamper resistance.
NOTE 2: Selection of system components may also serve to resist tampering (bypass,
jumpering, defeat of interlocks, etc.).
NOTE 3: Tamper resistance may be achieved by physical layout of equipment. Restricting
access to areas is another form of physical layout that improves tamper resistance.
NOTE 4: Tamper resistance may also be achieved by the physical configuration of
components. Designs that limit or prohibit mechanical manipulation of the controls improve
tamper resistance.
NOTE 5: Tamper resistance need not be physical. Passwords that restrict access
represent another form of tamper resistance.
NOTE 6: Another form of tamper resistance is technical sophistication or complexity.
Tamper resistance is improved if bypassing a system requires having access to, and being
able to read, the system schematics. Systems that require specialized skills to operate
have greater tamper resistance than those that do not.
8.2.11 Program to Support
The program supporting an alternative method shall be evaluated. Alternative methods shall
include a program in place to support the control of hazardous energy (see clause 6). The tasks
that may be performed using the alternative method(s) shall be documented.
NOTE 1: The purpose of a hazardous energy control program is to ensure that risk of
exposure to the release of hazardous energy will be eliminated or minimized before any
authorized person performs a reasonably foreseeable activity on a machine, equipment or
47
process where the unexpected energizing, start-up or release of stored energy could occur
and cause injury.
NOTE 2: The documentation of the tasks which may be performed using a specific
alternative method is intended to prevent task creep.
8.2.12 Procedures in Place
The procedures in place to support an alternative method shall be evaluated. Alternative
methods shall include developing, documenting and using procedures when affected persons
are engaged in the activities requiring the control of hazardous energy.
8.2.13 Periodic Check and Test
The effectiveness of alternative methods shall be periodically checked and tested. Check/test
shall be required when changes are made to the machine, equipment or process, or to the
alternative methods in place (see clause 6.6). The check and test applies to both the
procedures used to control hazardous energy and to the system used for protection.
NOTE: The purpose of the check and test is to ensure that the alternative methods
implemented to control hazardous energy remain effective and relevant. Where alternative
methods are used to control hazardous energy, the need for checking is especially
important because over time equipment, operations and work methods can change in
small and large ways. Without a program that requires periodic checking and testing,
alternative methods can become outdated to the point that they no longer provide
adequate protection.
Checking and testing shall also include correcting any deviations or inadequacies identified.
8.2.14 Review by a Qualified Person
Where necessary, an alternative method shall be reviewed by a qualified person.
NOTE: The persons developing the alternative method should use due diligence
throughout the process in order to achieve a high level of confidence in the results.
Confidence can be improved by consulting others who possess the appropriate knowledge
and expertise, and by having other qualified persons review the design.
8.3 Reliability/Effectiveness of Alternative Methods
The level of reliability/effectiveness of alternative methods shall be appropriate for the risk.
8.3.1 Engineered Controls/Safeguards
When using any engineered controls/safeguards as an element of an alternative method, the
following factors shall be considered:
 whether the devices are appropriate for the application and environment;
 whether the installations are in accordance with any instructions provided by the
manufacturer; and
 whether the installations are in accordance with applicable standards.
Engineered devices such as blocks, racks, supports, pins, etc. shall be designed and built using
appropriate safety factors.
8.3.2 Control System Safety Performance
Control system safety performance shall be evaluated to determine the reliability/effectiveness
of alternative methods.
48
The control system selected shall be of sufficient safety performance to provide protection for
the established level of risk (see Annex V for example methodologies for determining control
system performance).
NOTE 1: For more detailed information on control circuit safety performance, see ANSI
B11.26, ISO 13849-1, ANSI B11.19, NFPA 79 and other sources.
NOTE 2: A key point of checking the control system safety performance is to ascertain if
the required design specification (performance level required (PLr) or category) has been
achieved. The check should determine if the achieved PL or category is equal to, or higher
than, the PLr or category required.
8.3.3 Zoned or Partitioned Machines or Equipment
Alternative methods may be applied to zones or partitions rather than an entire machine,
equipment or process. See also ANSI B11.20.
8.4 Special Applications
8.4.1 Remote or Noncontiguous Locations
Where isolation devices are in a remote or noncontiguous location, written procedures shall be
used in conjunction with written authorizations to ensure that authorized persons performing the
work verify the isolation and de-energization or re-energization through direct communication
with personnel designated in the procedure.
NOTE: Examples of remote or non-contiguous locations are:
 pipeline operations with widely spaced pump stations, including those connecting offshore oil
and gas production to onshore terminals and gas transmission and distribution systems,
including underground gas storage systems, gas wells and compressor stations
 electric power transmission and distribution systems
8.4.2 Freeze Plug Technology
The application of freeze plug technology for isolation of piping systems shall provide an
effective level of protection for exposed personnel and follow the same practices required in
clause 6.3 for the lockout or tagout of hazardous energy sources. See Annex W for detailed
requirements.
8.4.3 Inflatable Bladders/Pipe Plugs
The application of inflatable bladder/pipe plug technology for isolation of systems shall provide
an effective level of protection for exposed personnel and follow the same practices required in
6.3 for the lockout or tagout of hazardous energy sources. The user shall use risk assessment
for each task application to determine the necessary alternative measures to protect personnel
from the release of hazardous energy.
NOTE: There are numerous applications for pipe, culvert, shaft and duct systems that use
inflatable technology (pneumatic pressure) to restrain, contain or isolate liquids, materials,
chemicals and gasses. Hot tapping (excluded from this standard) also uses this technology
to safeguard personnel while performing required tasks.
8.4.4 Other Means of Hazardous Energy Control
Remotely activated electro-mechanical lockout systems are an acceptable alternative to be used
in selected applications such as long machines and inaccessible or inconvenient locations of
primary isolation devices. The user shall install and operate such systems (e.g., remote low
voltage lockout system, pneumatics systems) in accordance with the manufacturer’s directions.
See Annex B for further details. See NFPA 79 for additional information.
49
8.4.5 Provisions for Alternative Method Interruption

In situations in which alternative methods must be temporarily discontinued so that the machine
or equipment may be energized to test or position the machine, equipment or component
thereof, the following sequence of actions shall be followed:
 Clear the machine or equipment of tools and materials.
 Remove affected persons from the machine or equipment area.
 Temporarily discontinue alternative methods.
 Provide a safe position for persons.
 Position the machine, equipment or process.
 Perform the task.
When the hazardous energy is no longer needed, reapply the alternative methods.
50
Annexes
Annex A The Risk Assessment Process
(from clauses 5.1, 5.2, 6.1, 8.1.1)
(Informative)
Annexes are included to provide the user with additional information related to the subject of the
standard. Annexes are not part of the requirements of this standard.
A.1 Risk Assessment
Risk assessment is an analytical tool consisting of a number of discrete steps intended to insure
that hazards are properly identified, that associated risks are evaluated, and that appropriate
risk reduction measures are taken to reduce those risks to an acceptable level. Typical
elements of a risk assessment process include the following steps.
NOTE – Additional details on specific risk assessment methodologies are found in the
following documents ANSI B11.0, ANSI/PMMI B155.1, ANSI/ISO 12100, ISO 14121-2, RIA
TR R15.306, SEMI S10, MIL STD-882E, ANSI/ASSE Z10 and others in the Bibliography.
A.1.1 Identify all Tasks and Task Elements
All tasks and activities should be considered. Examples of activities for which tasks should be
identified include set up, installation, removal, maintenance, operating, adjusting, cleaning,
troubleshooting and programming.
For each task, identify the task elements or steps.
In particular, tasks that require power and control functionality (e.g. causing machine
movement) to perform the task should be identified.
In addition, tasks that require the ability to enter a machine or hazardous area, but does not
require control functionality (no machine movement needed), should be identified.
A.1.2 Identify Hazards
Hazards, such as mechanical, electrical, thermal, pneumatic, hydraulic, radiation, residual or
stored energy, motion, fuels and human factors associated with each task should be
considered. Associated hazards for a particular task not related to hazardous energy release
may also need to be reviewed.
Consideration should include human error, management system deficiencies and foreseeable
improper use of equipment.
A.1.3 Assess the Risks
The risks associated with each hazard should be assessed. The elements of risk are shown in
Figure 3.
Figure 3 – Elements of Risk
51
A.1.4 Assess the Potential Severity of Harm

Assess the severity of injuries to all persons that could be harmed by the hazards. This includes
other persons who may be affected by the task. The most credible severity of the harm should
be considered for each task.
A.1.5 Assess the Probability of Occurrence
For each hazard or task/hazard pair, the probability of occurrence of harm shall be assessed.
Occurrence probability is estimated taking into account the frequency, duration and extent of
exposure, speed of occurrence, human errors, training and awareness and the characteristics of
the hazard. When estimating probability, the highest credible level of probability shall be
selected.
NOTE: Predicting the probability of harm occurring is difficult. Unless quantitative data are
available, the process of selecting the probability of harm occurring will be subjective
(qualitative).
The probability of occurrence of the hazardous event can be influenced by the following factors:
 safeguards, safety devices and safety systems either in use or to be used;
 system performance/reliability history and failure modes;
 operational or maintenance demands of the task;
 possibility of defeat or failure of safeguards;
 accident history relating to the particular task, activity, machine, equipment or process;
 the competence of all persons performing the task; and
 the working environment.
NOTE: Risk assessment often relies on subjective decisions. These decisions should be
supported by qualitative methods that are complemented, as far as practicable, by
quantitative methods. Quantitative methods are particularly appropriate when useful data
are available. However, in most applications, only qualitative risk assessment will be
practicable.
A.1.6 Evaluate the Risk
The information in A.1.1 through A.1.5 should be evaluated for each identified hazard and task
to determine the level of risk. Based on this process, a determination of the acceptability of the
risk level can be made. The determination may involve risk comparisons, consensus appraisals
or informed value judgments.
A.2 Acceptable Level of Risk
If the evaluation in A.1.6 determines the risk to be acceptable, then the process is completed
until a review is required (see A.5). If the risk(s) is determined to be unacceptable, then the risk
reduction process in A.3 should be implemented.
A.3 Risk Reduction (Implementation)
Risk reduction is a hierarchical process employed to reduce or control risk by elimination
through design, use of engineered safeguards, awareness means including warning and
alerting techniques, administrative controls including safe work procedures and training, and
use of personal protective equipment. Often, for any particular machine, equipment or process,
the solution may include aspects of each of these elements. The risk reduction process should
involve the appropriate personnel, should be documented and should adhere to the process
outlined below and illustrated in Figure A.2.
NOTE: The following questions should be asked to determine the adequacy of the risk
reduction process:
52
 Is the safety level adequate? Can the task be performed without causing harm or damage to
health?
 Have appropriate safety measures been taken for all tasks or activities? Are the measures
taken compatible with each other?
 Do the safety measures generate any new, unexpected hazards or problems?
A.3.1 Risk Reduction by Design
Risk reduction should first attempt to eliminate the hazard through design. The primary objective
in implementing design features is to eliminate hazards or reduce their risk by substitution.
A.3.2 Risk Reduction by Use of Engineering Controls
Engineering controls should be used to protect personnel from hazards that cannot be
reasonably eliminated or sufficiently reduced by design.
Engineering controls and the associated safety control system (electrical, pneumatic, hydraulic,
etc.) should be of a suitable architecture and reliability for the risk reduction that is required.
NOTE: Examples of engineered controls include, but are not limited to guards (both fixed
and interlocked), trapped key devices, trip devices (light curtains, laser scanners, pressure
mats, safety rated switches, etc.). Complementary devices include for example, emergency
stop buttons, enabling or hold to run devices, etc.
A.3.3 Risk Reduction by Use of Warning and Awareness Devices
Warning and awareness devices should be used to warn personnel of hazards that cannot be
reasonably eliminated or sufficiently reduced by design, engineered controls or a combination of
these elements.
NOTE: Examples of warning and awareness techniques include attendants, audible and
visual signals, barricades, signs and tags.
A.3.4 Risk Reduction by Use of Administrative Controls
Additional risk reduction is achieved by the use of administrative controls including safe work
procedures, standard practices and checklists and training. These should be used to control risk
that cannot be reasonably eliminated or sufficiently reduced by the use of design, engineered
safeguards, warning and alerting techniques or a combination of these elements. Training
should be used as a complement to all the risk reduction methods described here.
NOTE: Examples of safe work procedures, practices and training include standard
operating instructions, illumination, pre-job review and establishing safe distances from a
hazard. Examples of types of training that can be used to develop proficiency of authorized
persons may include computer based, simulation, drills, classroom or exercises.
A.3.5 Risk Reduction by Use of Personal Protective Equipment
Additional risk reduction is achieved by effective use of prescribed personal protective
equipment (PPE). Strong administrative procedures shall be in place in order for the PPE to be
an effective safeguard.
NOTE: Personal protective equipment can include safety eyewear or shields, footwear,
protective gloves (insulating or cut resistant) and protective headgear.
A.4 Repeat the Risk Assessment Process
When the risk reduction has been completed, the risk assessment process should be repeated
(see A.1 and A.2). Consideration should include the risk reduction methods chosen (including
factors stated in A.1.5), any new tasks generated and any new hazards generated.
53
If the risks have been deemed to be acceptable, then the iterative process is complete until a
review is required (see A.5). If the risks are not yet deemed to be acceptable, then the risk
reduction process should be repeated (see A.3), followed by a repetition of the risk assessment
as described in this section.
A.5 Review the Risk Assessment and Risk Reduction
The risk assessment and risk reduction should be reviewed:
 following its implementation to ensure solutions are effective and in place;
 following an incident or near miss;
 whenever new tasks or activities are required;
 whenever there are modifications to the machine, equipment or process;
 on a periodic basis.
54
Figure – A.2 Sample Risk Assessment for Alternative Risk Reduction Measures
55
56
Annex B Remote Lockout System

(from clauses 5.4.1 and 8.4.4)
(Informative)
Remotely activated electro-mechanical, pneumatic, hydraulic lockout systems may provide an
acceptable alternative to hazardous energy isolation devices located directly on machines,
equipment and processes, which are located in inaccessible or inconvenient locations. These
devices allow for a conveniently located lockout activation device that are user friendly, accept a
padlock for personal control, are located at multiple process points and therefore encourage the
proper application of lockout protection.
This technology uses a dedicated system of lockable dual channel low-voltage safety switches
located at multiple locations around a production machine to activate a lockout. The low-voltage
lockout circuit de-energizes the dual electro-mechanical power contactors that disconnect the
incoming power after the main disconnect switch. These units use redundant circuitry and
monitoring by safety relays to insure the proper activation and deactivation for fault free
operation. If a fault does occur and is sensed as non-simultaneous activation of any component,
the system will not allow reactivation of the machine until the repair is made. These devices
must be installed and maintained in accordance with manufacturers’ guidelines by qualified
personnel.
Justification to use a remote lockout system instead of a manual disconnect for service
disconnect isolation purposes includes:
 When frequency of the task exceeds the capability of a manual disconnect. Changing the
disconnect frequently due to failures is an inherently dangerous task.
 When environment is not acceptable to place a manual disconnect.
 Large complicated machinery involving many lockout devices making the lockout procedure
too cumbersome.
 Reduce to a single lock point directly at the access point.
 To prevent machine operators from standing in front of large disconnect switches in case of
short circuit fault.
 Large disconnects can be physically hard to operate for some operators.
 Required spaces not available (service access, electrical hazards, adequate ventilation,
etc.).
NOTE: Types of electrical lockout systems available include, but are not limited to remote
low voltage system and listed system isolation equipment.
57
Annex C Sample Lockout or Tagout Program and Policy

(from clause 6.3)
(Informative)
I. Purpose
To establish a control system and utilize procedures to prevent the unexpected release or
transmission of machine equipment/process energy.
II. Objectives
A. Prevent inadvertent operation or energization of the machine equipment/process in order
to protect personnel.
B. Establish methods for achieving hazardous energy control.
C. Comply with applicable regulatory standards.
III. Scope
A. This policy applies to activities such as erecting, installing, constructing, repairing,
adjusting, inspecting, cleaning, operating or maintaining the equipment/process.
B. This policy applies to energy sources such as electrical, mechanical, hydraulic,
pneumatic, chemical, radiation, thermal, steam, compressed air, energy stored in
springs and potential energy from suspended parts (gravity).
C. International facilities will comply with the substance of this policy or the prevailing
national requirements whichever is more stringent.
D. Installation design requirement. After January 1, 1990, whenever replacement or major
repair, renovation or modification of a machine or equipment is performed, and
whenever new machines or equipment are installed, energy-isolating system shall be
designed to accept an energy isolation device.
IV. Definitions
A. Lockout. The placement of a lockout device on an energy-isolating device, in
accordance with an established procedure, ensuring that the energy-isolating device
and the equipment being controlled cannot be operated until the lockout device is
removed.
B. Lockout Device. A device that utilizes a positive means, such as a lock, to hold an
energy-isolating device in a safe position and prevent the energizing of a machine or
equipment.
C. Capable of Being Locked Out. An energy-isolating device that is designed with a hasp
or other means of attachment to which, or through which, a lock can be affixed, or if it
has a locking mechanism built into it. Other energy-isolating devices will also be
considered to be capable of being locked out, if lockout can be achieved without the
need to dismantle, rebuild or replace the energy-isolating device or permanently alter its
energy control capability.
D. Tagout. The placement of a tagout device on an energy-isolating device, in accordance
with established procedure, to indicate that the energy-isolating device and equipment
being controlled may not be operated until the tagout device is removed.
E. Tagout Device. A prominent warning device such as a tag and means of attachment
which can be securely fastened to an energy-isolating device in accordance with an
58
established procedure, to indicate that the energy-isolating device and the equipment
being controlled may not be operated until the tagout device is removed.
F. Affected Employee. An employee whose job requires them to operate or use a machine
or equipment on which servicing or maintenance is being performed under lockout or
tagout.
G. Authorized Employee. A person who locks out or tags out machines or equipment to
perform the servicing or maintenance on that machine.
H. Other Employee. An employee whose job requires them to work in an area in which
machine/equipment servicing or maintaining is being performed.
I. Servicing/Maintenance. Workplace activities such as constructing, installing, setting up,
adjusting, inspecting, modifying and maintaining and/or servicing machines or
equipment. These activities include lubrication, cleaning or unjamming of machines or
equipment and making adjustments to tool changes where the employee may be
exposed to the unexpected energization or start-up of the equipment or release of
hazardous energy.
V. Procedure
A. Lockout or Tagout System. Each facility shall develop a written hazardous energy
control policy, which incorporates the following elements:
1. Principles
a. All personnel (hourly and salary) shall comply with the provision of the lockout
or tagout system. Supervision must enforce the use of personnel locks or tags
to insure protection when personnel performing tasks where exposure to
unexpected energization can occur.
b. The locks/tags shall be standardized throughout the facility and only authorized
method be used for the lockout or tagout of hazardous energy sources.
Locks/tags shall not be used for any purpose other than personal protection.
c. Individual locks/tags shall be applied and removed by each person exposed to
the potential for unexpected release of hazardous energy, other than in those
special situations where specific facility procedures where alternative methods
have been developed.
d. Where equipment is lockable, use of a lock is required by all exposed
personnel.
e. Where equipment is not lockable, special lockout or tagout methods shall be
utilized.
f. When locks are used in the lockout or tagout application, they shall always be
accompanied by tags.
1) Locks used for personnel protection shall be accompanied by employee
tags.
2) Locks used to protect against hazards shall be accompanied by caution
tags.
g. Energy-isolating mechanism shall be identified to indicate its function unless
located and arranged so its purpose is evident. Such identification is necessary
to reduce possible errors in applying the lockout or tagout.
59
h. The lockout or tagout of electrical energy sources shall occur at the circuit
disconnect switch servicing specific machine/equipment or function. (Note:
Facilities shall identify any situations where the circuit cannot be effectively
interrupted, alternative methods providing equivalent protection should be
implemented.)
i. The use of performance level circuitry to accomplish lockout or tagout is
acceptable when prescribed techniques and methods for controlling hazardous
energy identified through a risk assessment have been effectively applied.
2. Protective Appliances
a. Locks. Shall be purchased specifically for lockout applications. They shall be of
such design and durability that removal by other than abnormal means would
require excessive force or unusual techniques. In addition, they shall be
individually keyed and identified.
b. Tags. Appliances that are used to provide warning or information when the
individual lock does not identify the owner.
1) Employee Tag. Used only for personnel protection; clearly distinguishable
from caution tags and shall include a legend such as DO NOT START; DO
NOT OPERATE or a similar directive that informs employees working in the
area not to start-up the equipment.
2) Caution Tag. Provides a warning of hazards. It does not indicate that the
applier is currently exposed to the unexpected release or transmission of
hazardous energy.
c. Lockout Fixture. An appliance that accommodates one or more locks to secure
an energy-isolating device.
d. Additional Protecting Appliances. Some exposures may require additional
protective techniques or mechanical safeguards (example: plug lock).
3. Risk Assessment
a. Each facility shall conduct a risk assessment to determine how the hazardous
energy of the equipment/process can be effectively isolated.
1) The risk assessment should determine if energy-isolating technologies are
readily available and adequate for effective protection.
2) A plan shall be developed and implemented to address identified
deficiencies or provide interim alternative methods of protection in order to
make the lockout or tagout system effective.
b. Each facility shall conduct a risk assessment to determine what tasks are being
performed (i.e., cleaning rolls, removing jams, etc.), with equipment energized.
Each task shall be evaluated to determine if the task can be accomplished with
the power off or what alternative method must be used to reduce employee
risk.
4. Responsibilities
a. Management is responsible for developing, implementing and assessing the
effectiveness of the lockout or tagout system.
b. All employees are responsible for complying with the provisions of the facility
60
lockout or tagout system.

c. Affected employees shall be aware of lockout or tagout procedures used to
prevent unexpected start-ups.
d. Only authorized persons shall operate hazardous energy-isolating devices and
place locks or tags on controls to prevent unexpected start-ups.
e. Other employees who work in the area where lockout or tagout procedures are
used shall be trained regarding their purpose and prohibited from attempting to
restart machines or equipment that are locked or tagged out.
B. System Utilization
1. Preparation for Lockout or Tagout
a. All personnel affected by the intended lockout or tagout shall be notified by the
supervisor or authorized employee before commencing any work.
b. A method shall be established to permit access to the equipment/process. This
method should involve acknowledgement and release by the person(s)
responsible for the equipment/process.
c. A pre-job plan shall be developed to insure appropriate lockout or tagout when
the equipment/process complexity or nature and scope of work warrants (i.e.,
job objectives and involved equipment/process; estimated job duration; crafts
involved; type, number and location of energy-isolating devices or methods,
start-up provisions, etc.).
2. Application of Lockout or Tagout
a. Use appropriate equipment/process shutdown procedure(s) to deactivate
operating controls or return them to the neutral mode.
b. All involved energy-isolating devices or controls shall be operated/positioned in
such a manner as to isolate the equipment/process from hazardous energy
source(s).
c. Lock and tag shall be applied to each energy-isolating device or control by
authorized employees.
1) Lockout fixtures and locks shall be attached in such a manner as to hold
the energy-isolating device(s) in an isolation position.
2) Employee tags shall be completed by the applier and attached to the
energy-isolating device(s) when required.
d. After lockout or tagout application and prior to commencement of work, one or
more of the following actions shall be taken:
1) Operate the equipment/process controls (push buttons, switches, etc.) to
verify that energy isolation has been accomplished. Controls must be
deactivated or returned to the neutral mode after test.
2) Check the equipment/process by use of test instruments and/or visual
inspection to verify that energy isolation has been accomplished.
e. The equipment/process shall be examined to detect any residual energy. If
detected, action must be taken to relieve or restrain the hazardous stored
energy.
61
3. Release from Lockout or Tagout

a. Each lock or tag shall be removed by the authorized person who applied it
prior to leaving the job.
1) A procedure shall be developed to deal with instances where employees
have left the jobsite without clearing their personal lock or tag.
b. The person responsible for the equipment/process (affected employee) shall
be notified when the work is complete and the overall lockout or tagout has
been cleared.
1) Before equipment/process energization, visual inspection of the work area
should be made to insure that all personnel are in the clear and that all
nonessential items, including tools, have been removed and components
are operationally intact.
4. Specific Procedures
Each facility will develop specific hazardous energy isolation, de-energization and
verification procedures for major machines/equipment/process components/utilities,
etc. A “Lockout or Tagout Checklist for Energy Isolation or Job Safety Analysis” is
suitable for this requirement.
C. Special Lockout or Tagout Situations
1. Lockout or Tagout Interruption (Energized Testing)
In situations where the energy-isolating device(s) is locked or tagged and there is a
need for testing or positioning of the equipment/process, the following sequence
shall apply:
a. Clear equipment/process of tools and materials.
b. Clear personnel.
c. Clear the energy-isolating device(s) of locks or tags according to established
procedure.
d. Proceed with test.
e. De-energize and relock or retag energy-isolating device(s)/methods to
continue the work.
f. Operate controls, etc., to verify energy isolation.
2. Exposure of Contractors
a. Company and outside employers (contractors, etc.) shall inform each other of
their respective lockout or tagout procedures.
b. Each facility shall insure that its employees understand and comply with the
requirements of the outside employer’s or mutually agreed upon energy control
procedures.
3. Multiple Personnel Protection
For major process/equipment overhaul, rebuilds, etc., which require crew, craft,
department or other group lockout or tagout, a system is required that affords
employees a level of protection equivalent to that provided by personal lockout or
tagout.
62
4. High Voltage Work

Special written procedures shall be developed to describe the lockout or tagout
measures necessary when employees are required to work on high voltage circuits
or equipment (above 600 volts).
5. Shift Change
Facilities shall develop specific written procedures to accommodate those
situations where it is necessary to continue the current lockout or tagout of the
equipment/process into subsequent shifts.
VI. Alternative Methods
Equipment/process tasks such as jogging, threading coil/stock, etc. may necessitate
employee activity under energized conditions. Each such task must be assessed to
determine what safeguarding techniques are effective to minimize the risk exposure to the
hazards to an acceptable. (See V.A.3.b.)
VII. Education and Training
A. Training shall be provided prior to assignment to insure that employees understand the
purpose and function of the plant lockout or tagout program and that the knowledge and
skills required for the safe application, use and removal of energy controls are acquired.
The training shall include the essential elements of §1910.147 and the following:
1. Each affected employee shall be instructed in the purpose and use of the energy
control procedure.
2. Each authorized employee shall receive training in the recognition of applicable
hazardous energy sources; the type and magnitude of the energy available in the
work place; the methods and means necessary for energy isolation and control;
and the means of verification of control.
3. Other employees whose work operations are or may be in an area where energy
control procedures may be utilized shall be instructed about the procedure and
about the prohibition relating to attempts to restart or re-energize machines or
equipment which are locked out or tagged out.
B. Retraining shall be provided annually to re-establish employee proficiency with control
methods and procedures.
1. Retraining shall be provided for all affected and authorized employees whenever
there is a change in job assignments; a change in machines, equipment or
processes that present a new hazard; or when there is a change in the energy
control procedures or revision of control methods.
2. Additional retraining shall be conducted whenever periodic audits (see VIII,
Management Controls) reveal or whenever supervisory observations give reason to
believe that there are deviations from or inadequacies in the employee’s knowledge
or use of energy control procedures.
C. Plant documentation shall certify that employee training has been accomplished and is
being kept up-to-date. The certification shall contain each employee’s name, clock
number and dates of training.
VIII. Management Controls
A. Each facility shall develop and document a formal compliance audit of the lockout or
63
tagout energy control procedure semiannually as a minimum to insure that employees

are knowledgeable and utilize the designated procedures. The documentation shall
identify the machine or equipment on which the energy control procedure was being
utilized; the date of the inspection; the employees included in the inspection; and the
person performing the inspection.
1. An authorized management employee shall perform annual audits.
2. The amount of lockout or tagout auditing should adequately represent the size of
the plant and number of authorized employees.
3. The audits shall be designed to correct any deviations or inadequacies observed.
4. Where lockout is used for energy control, the audit shall include a review between
the inspector and each authorized employee of that employee’s responsibilities
under the energy control procedure being audited.
5. Where tagout is used for energy control, the audit shall include a review, between
the inspector and each authorized and affected employee, of that employee’s
responsibilities under the energy control procedure being audited to insure that
employees understand the limitations of a tagout system and their purpose in the
energy control program.
6. Where tagout procedures are used, other employees whose work operations are or
may be in the area shall be contacted by supervision to insure that they are aware
of and understand the purpose of the procedures.
NOTE: If compliance with any element of this procedure is not practicable, effective
protection shall be provided by an alternative method approved by the safety department.
64
Annex D Sample of a Lockout or Tagout Application Inspection Form

(from clause 6.5.2)
(Informative)
LOCK/TAG/VERIFY PERIODIC INSPECTION

Date: Area:
Inspector(s):
[ ] [ ] Contractor Crew/Team/Shift:
Equipment:
Task:
Lockout Task ID: Lockout Task Date:
Authorized Employees: (Maintenance/Production who works on the equipment)
1. Job Position:
2. Job Position:
3. Job Position:
4. Job Position:
Affected Employees: (Operators who work with the equipment)
1. Job Position:
2. Job Position:
3. Job Position:
4. Job Position:
Energy-Isolating Device (Check all that apply):
Electrical – Disconnect – Lock Hydraulic – Stored Energy – Lock
Electrical – Breaker Switch – Switch Device Pneumatic – Ball valve.
Electrical – PLC – Lock Process – Line - Break in Line. Block in Line.
Mobile Equipment – Battery – Key Control Mechanical – Mobile Equipment – Blocking device
1. Was the location (affected personnel) notified of work to be performed? Y N NA
2. Have authorized employee’s responsibilities been reviewed with them? Y N NA
3. Does a written Lockout Task Procedure exist for the task? Y N NA
4. If “Yes,” was it followed? Y N NA
5. If “No” explain how it was determined what to lock out. Y N NA
6. Do authorized employees know where to find the Lockout Procedure? Y N NA

7. Is all necessary hardware available to operators? (locks/tags/lockboxes/) Y N NA
8. For equipment with a single isolation device: Was the isolation device Y N NA
properly identified?
65
9. Were the isolation devices properly identified on the Lockout Task Y N NA

Procedure?
10. Were equipment locks attached to the proper isolation device? Y N NA
11. Were the correct number of equipment locks applied? Y N NA
12. Did each authorized employee on the job have his or her personal lock and Y N NA
tag attached to the equipment or lockbox?
13. Was the proper information on the personal tag? Y N NA
14. Was the Stop/Verification Tag* properly filled out and legible? Y N NA
15. Was the bottom portion of the tag retained by the authorized person Y N NA
controlling the lockout?
16. Were the isolation device(s) tested to be sure they could not be moved to the Y N NA
unsafe or on position?
17. Were the machine start controls tested to be sure the machine or equipment Y N NA
could not start? (The location could be the control panel, start button, toggle,
etc.)
18. Was the on/off switch returned to the off or safe position following the test? Y N NA
19. Were the proper number of keys retained in the lock box? Y N NA
20. Are all personal lock keys in possession (control) of everyone who locked Y N NA
out?
21. Inspector’s overall assessment: Did authorized employees understand their Y N NA
responsibilities under the energy control procedure being inspected?
Comments:
22. Were any deficiencies identified? Y N NA

If Yes, were the identified deficiencies reviewed with all affected employees? Y N NA
If Yes, signature of employees required below after the deficiencies and
temporary control actions are resolved with employees.
Signature of Inspector(s): Signature of Employees
_____________________________________ ______________________________________
_____________________________________ ______________________________________
_____________________________________ ______________________________________
_____________________________________ ______________________________________
Temporary Control Actions:
______________________________________________________________________________
______________________________________________________________________________
______________________________________________________________________________
66
Place a copy of this form in the identified box in the process area or return to a member of the
lock/tag/verify (LTV) committee or LTV champion. Copies of this inspection form must be
retained for one year.
* If all four of the following conditions are met, a stop/verification tag is not required for a lockout.
If any one of the four conditions change during the lockout, the requirements of stop/verification
tag requirements apply.
 No more than two persons are being protected by the lockout.
 The person(s) being protected by the lockout do not leave the area while the lockout is in
effect.
 The person(s) being protected by the lockout also perform the lockout.
 The duration of the lockout will not extend past the end of the current shift.
67
Annex E Sample Management of Change Form

(from clause 6.6)
(Informative)
68
69
Annex F General Lockout or Tagout Procedure

(from clause 7.2)
(Informative)
Purpose
The purpose of this procedure is to prevent harm to employees from unexpected start-up,
energization or release of stored energy from machinery or processing during servicing or
maintenance of equipment.
Scope
This standard specifies the minimum locking, tagging, clearing and verifying procedures
required to prevent harm from start-up or release of hazardous energy.
Steps to Follow:
Step 1. Preparation For Shutdown – Employees authorized to lockout or tagout equipment
shall identify the type and magnitude of the energy to be controlled, all hazards
(including stored energy) and the method or means of controlling the energy. They
shall also notify all affected persons in the area that the equipment will be locked or
tagged out.
Step 2. Equipment Shutdown – The equipment shall be shut down by following established
shutdown procedures.
Step 3. Equipment Isolation – Use of disconnect switches, line valves, blocks, blinds, removal
of spools and capping of lines, etc. shall be used.
Step 4. Application of Lockout or Tagout Devices – Locks or tags shall be applied to the
isolation device. Each employee working on the equipment shall be responsible for
attaching their personal locks without exception.
Step 5. Stored Energy – After applying locks or tags to the energy isolation devices, all
potentially hazardous stored or residual energy must be relieved, blocked, bled,
restrained or rendered safe.
Step 6. Verification of Isolation – Prior to starting work, after isolation and locking or tagging
energy sources, turn on (try) all start buttons and other activating controls on the
equipment to make sure the equipment has been de-energized. Be sure to return all
controls to the off or neutral position after trying to start.
Step 7. Release From Lockout or Tagout Control – Prior to restoring energy to the equipment,
remove all tools, ensure all affected employees are clear and informed that energy to
the equipment will be restored and guards are in place. Then all locks or tags can be
removed and energy restored.
Specific Instructions:
1. No changes, adjustments or repairs that require shutting down the equipment will be
made without proper authorization.
2. If more than one employee works on the same equipment, each person must attach their
lock and tag.
3. When an employee is reassigned from a job, which is incomplete, and the equipment
must of necessity remain locked out, the employee involved will notify their supervisor
before removing their lock or tag. The supervisor will then lockout or tagout the
70
equipment or arrange for such lockout and tagging prior to the first employee removing
their lock and tag.
4. No attempt shall be made by anyone to operate a control device to which a lock or tag is
attached.
5. When a job is to be extended from one shift to another, the relieving employee or the
supervisor shall attach their lock or tag to the lockout device before the employee going
off shift removes their lock or tag. If the supervisor places their lock or tag on the device
instead of the oncoming employee, the oncoming employee shall place their lock or tag
on the device before starting work.
6. In the event an employee leaves a lock or tag on equipment and cannot be found, the
supervisor may have the lock or tag removed only after following the company’s
procedures.
7. When requested by operating personnel, maintenance personnel shall perform electrical
disconnects. The employees performing the work must go with the person making the
disconnect and attach their lockout or tagout device to the control device.
8. When locking out electrical disconnects, push buttons shall be tried to make sure the
correct switch has been opened.
9. In no case shall anyone be assigned to remove another employee’s lockout or tagout
device except the supervisor as authorized in number 6 above.
10. Locks and danger tags issued for use in performing lockouts will not be used for any
purpose other than as outlined.
11. A supervisor shall lockout or tagout equipment when the equipment is to be out of
service for an extended period of time (e.g. over eight hours).
12. Outside contractors shall be informed of lockout or tagout procedures and be required to
follow them.
71
Annex G Sample of a Hazardous Energy Control Procedure

(from clause 7.2 and 7.2.1)
(Informative)
72
73
Annex H Samples of a Lockout or Tagout Placard

(from clause 7.2 and 7.2.1)
(Informative)
74
75
Annex I Lockout Tagout Permit

Maintenance Work Order or Other Identifier: Start Date:
Line Manager: Division/Company: Cell Phone:
(Appointed) Authorized Employee: Division/Company: Cell Phone:
Service and/or Maintenance Purpose:
HAZARDOUS ENERGY CONTROL PROCEDURE (HECP) IDENTIFICATION:

Identify all energy source location, type, magnitude; isolation and dissipation steps; verification; and re-starting.
Additional tables may be attached as needed (e.g., process lockouts with multiple valve matrix access needs).
<example content>
Energy LOTO Energy Type / Procedure for Procedure for Verification Procedure Start-up
Source Location Magnitude LOTO Dissipating Energy Seq.
<source> <description> <Elect., 480v> <steps to <steps to dissipate <how is zero energy <Step
lockout> stored energy> state verified> No>
The following checks are intended to verify appropriate preparation and initiation steps have been completed. All
other procedural requirements for restoration to normal operations, testing/positioning, work transitions and shift
changes, and variances for lock removal shall be followed for this LOTO.
 Review relevant process(es) /schematics with  Apply Lockout and Tagout Device(s) in accordance
operations, engineering, etc. with identified HECP
 Notify affected employees  Release Energy in accordance with identified HECP
 Review completed HECP with all authorized  Verify in accordance with identified HECP
employees (utilize to create an HECP for future work)  Test for electrical current by a Task Qualified
 Shut Down equipment following normal operations Employee
 Isolate energy in accordance with identified HECP  Verify LOTO preparation and initiation complete prior
to commencement of service and/or maintenance.
List of additional Authorized Workers if applicable. Each worker must read the completed form and sign below.
Name: ______________________________ Signature: ______________________________
Date:__________________
76
Name: ______________________________ Signature: ______________________________

Date:__________________
Name: ______________________________ Signature: ______________________________
Date:__________________
Name: ______________________________ Signature: ______________________________
Date:__________________
Name: ______________________________ Signature: ______________________________
Date:__________________
*Attach additional sheets as needed
Note: Each authorized worker must apply their personal lock to the individual energy source(s) or to a group
lockout device that locks out the individual energy sources. Under no circumstances shall a worker relinquish their
individual control over an energy source. This safety form does not authorize live work.
Appointed Authorized: ________________________ Signature: ________________________

Date: _______________
AA (if transitioned): ___________________________ Signature: ________________________
Date: _______________
Completed form should be kept with the lock-box or with the authorized appointed authorized
employee.
77
Annex J Group Lockout Guidance

(from clauses 7.2, 7.10, 7.11)
(Informative)
Information source document: OSHA CPL 02-00-147 pp126-136
78
79
80
81
82
83
84
85
Annex K Group Lockout or Tagout
(Informative)
Figures
Figure K.1. Basic Group LOTO Figure K.2. Master Lockbox/Tagbox Figure K.3 Satellite Lockbox/Tagbox
Type A Type B Type C
(Courtesy Kaiser Aluminum) (Courtesy Kaiser Aluminum) (Courtesy Kaiser Aluminum)
see Annex J Group Lockout Guidance, section V
Figure K.4 Lockout/Tagout security pyramid for complex isolation

Source: Developed by E. Grund, copyright National Safety Council
86
Annex L-1 Sample Alternative Methods Practicability/Justification Evaluation

Alternative Method (Lockout) – Three Step Process (1) Justification Analysis (2) Risk Assessment (3) Alternative Procedure
(from clauses 8.1, 8.,2.1.3)
METHOD JSP #010-#016; LOTO
PLANT: DEPT: Extrusion NUMBER:
REFERENCE: 002
Tool Cleaning/Polishing/Adjustments; Tool Changes; Clearing
TASK: NEW EXISTING MODIFIED
Discard Chute/Shear; Pit Entry for Tool Recovery
TASK DATA: Define the task characteristics (frequency of occurrence, personnel exposed; use history, current key safeguard,
perceived risk)
30-40 times/8 hour shift; press operator; task history (20+ years); trapped circuit key control system; serious level risk
LOCKOUT IMPACTS: What is the impact of applying conventional lockout? (for example - process interruption, electrical device
wear, employee additional risk, task interference, power needed for task completion, etc.)
Each pump (4) shutdown requires a startup delay (5 minutes) to protect the pumps from fast cycling. Note: All press
container/ram production tasks would require each pump to be cycled an additional 30 times/shift. Cycling disconnects
multiple times causes excessive wear, potential failure and increased risk of arc flash.
POTENTIAL OPTIONS: What can be done to avoid using power or reducing employee exposure? (task elimination,
engineering/design changes; remote task completion; exposure reduction; product change, etc.)
Improved press settings (crush)-recipe control data to minimize aluminum buildup. Increased nitrogen flow to improve
surface condition, ensure billet lubrication system functioning properly
OPTION PRACTICABILITY: What obstacles exist that prevent using potential options listed above? (Limiting factors for task
power elimination; previous unsuccessful changes; inherent hazard/thermal, etc.)
Inherent formation of some aluminum buildup on die/container face dictates cleaning necessity; customer demand and
scheduling drives tooling changes
87
ELECTRICAL CONTROL RELIABILTY: Is the control system appropriate for the task risk? (Control system features-multiple
channel, hard wired, safety rated, self-monitoring, redundant components, positively guided relays, etc.)
Control system has parallel electrical redundant circuits through safety rated monitoring relays; hard wired installation;
external electrical consulting firm evaluated system design for installation
PREPARED BY: REVIEWED BY: APPROVED BY: DATE:
The alternative methods process for hazardous energy control is a task(s) oriented activity that is intended to achieve an
acceptable/tolerable level of risk for completing the work activity. Power of some type/magnitude is believed necessary for
reasonable task(s) accomplishment. Convenience or historical practice is not to be considered a legitimate basis for continuing the
task without conducting the risk assessment/reduction process. (Reference: ANSI/ASSE Z244.1)
88
Annex L-2 Sample Alternative Method (Lockout) – Risk Assessment

(List the elements that are related to machine guarding exposures or unexpected energization)
1. RISK FACTORS 2. HAZARD(S) 3. RISK 4. RISK REDUCTION MEASURES
a. Press container/ram area a. Exposure to unguarded press a. Install trapped key/interlock controlled
a. Serious
access container-ram movement barrier/gate system
b. General access to press b. Inadvertent entry while press b. Install trapped key/interlock controlled barrier
b. Medium
periphery components in motion system (complete press circumference)
c. Exposure to moving dummy block and c. Install trapped key/interlock to prevent press
c. Access to press pit c. High
discard elevators motions
d. Multiple team members exposed under d. Install 5 key hard wired safety control circuit
d. Single key press container/ram single safety key (exclusive personal with fail-safe features; extend tip holder beyond
access control via PLC or control issue); safety key component d. High home position-press logic will not allow loader to
conventional lockout potential failure; disconnect failure- extend or auto cycle to start; screen displays
excessive cycling “control power off” and “verify here.”
e. Train team members on applicable job safety
practices and alternative methods; conduct
e. Team member adherence to e. Team member failure to follow
e. Serious team member conformance observations and
established practices instructions; lack of knowledge/skill
audits; establish conformance zero tolerance
policy.
5. ALTERNATIVE METHOD JUSTIFICATION: Describe the critical reasons for using power while performing this task
Five 480v disconnects (SW corner press); each disconnect would be cycled 16 times/day; added non-productive time per shift=1.3
hours; excessive wear on hydraulic pumps/motors; other press production tasks add 20 times/day for each disconnect and an
additional 1.0 hours of non-productive time
89
COMPLETION GUIDE:
1. ELEMENTS – LIST ALL KEY ELEMENTS ASSOCIATED WITH THE TASK THAT RELATE TO GUARDING OR UNEXPECTED
ENERGIZATION
2. HAZARD(S) – IDENTIFY ALL HAZARDS FOR KEY ELEMENTS (EMPHASIS ON ANY GUARDING EXPOSURES OR FAILURES
RELATED TO UNEXPECTED ENERGIZATION)
3. RISK – DEFINE RISK USING RISK RANKING MATRIX (HIGH, SERIOUS, MEDIUM, LOW –JSP ROADMAP RISK REFERENCE)
4. RISK REDUCTION MEASURES – FOR EACH LISTED ELEMENT IDENTIFY THE MEASURE TO ELIMINATE OR REDUCE THE RISK
(CONSIDER THE HAZARD CONTROL HIERACHY); IS THE RESIDUAL RISK ACCEPTABLE/TOLERABLE?
5. ALTERNATIVE METHOD JUSTIFICATION – DEFINE THE LOGIC FOR NEEDING POWER FOR TASK EXECUTION
(CONVENIENCE/HISTORICAL PRACTICE IS NOT APPROPRIATE JUSTIFICATION ALONE)
PREPARED BY: REVIEWED BY: APPROVED BY: DATE:
90
Annex M Alternative Risk Reduction Measures in the Packaging Machinery

Industry
(from clause 8.1)
(Informative)
Packaging machinery is used in industrial and commercial applications to perform packaging
functions for primary, secondary and tertiary applications. Packaging machinery is used in many
industries including food, pharmaceutical, bottling, consumer and others. In food applications,
packaging machinery has to be cleaned, often to a microbiological level, in order to protect
consumers.
In the packaging industry, lockout procedures cannot be used to clean some machines because
not all surfaces can be accessed in a stopped condition. As a result, alternative methods must
be used.
Figures M.1 to M.3 show an example of an alternative method used in the packaging industry
for wash down cleaning. The alternative method includes:
 fixed and moveable guards
 interlocks on the moveable guard doors
 special cleaning mode for the machine that limits the opening of only one guard door at a
time
 slow speed
 hold to run button
 restricted users that are trained in the safe work procedures for cleaning
Figure M.1 – Bottling machine with guard doors closed.

Hold to run control shown on left.
91
Figure M.2 – Interlock switch on movable guard door
Figure M.3 – Interlocked door opened for wash down cleaning
92
Annex N Alternative Risk Reduction Measures in the Pharmaceutical Industry

(from clause 8.1)
(Informative)
Pill presses are machines that are used to compress powders into pills.
A tablet or pill press is a mechanical device that compresses powder into tablets of uniform size
and weight. In the pharmaceutical industry, a pill press is used to manufacture tablets of a wide
variety of medicines and cosmetics. To form a tablet, the granulated material must be metered
into a cavity formed by two punches and a die, and then the punches must be pressed together
with great force to fuse the material together.
Typically, these processes are performed in a clean room environment with limited access.
When a jam occurs on a press that cannot be automatically cleared, an operator must enter the
room and open the press. Modern presses include interlocking guard doors that prevent
movement of the press when the door(s) is open.
For machines that have sufficiently reliable control systems, operators are able to rely on the
interlock door systems in lieu of lockout. Because the interlocked control system is of sufficient
reliability to ensure that no single fault will result in the loss of the safety function, an unexpected
restart will not occur when the door(s) is open.
This alternative method enables the operator to clear the jam quickly and effectively without risk
of an unexpected startup.
93
Annex O Alternative Risk Reduction Measures for the Plastics Industry

(from clause 8.1)
(Informative)
Injection Molding Machines (IMM) (see also, ANSI/SPI B151.1)
Mold Set-Up and Machine Maintenance
On plastics molding machines where it is necessary to maintain heat to a plasticizing unit or
power to the programmable logic controller or microprocessor during mold change only, a user
shall do one of the following:
 provide and use a separate lockable energy-isolating device for a motor, pump or any other
equipment, which could expose personnel to a hazard; or
 for a plastics molding machine that is in compliance with the current applicable safety
standards, the controlling safety gate shall be locked in the open position with the power
source(s) used for controlling motion/movement in the mold area turned off.
Effect of Gravity
When dangerous movement(s) in the mold area can be produced by the effect of gravity, a
mechanical restraint device shall be used.
Blow Molding Machines/Set-Up with Motion (see also, ANSI/SPI B151.3)
Blow molding machines shall be designed to enable setting movements to be undertaken from
the outside of the closed guards.
Where there are points on the machine at which the set-up mode can only be undertaken with
guards opened, the machine shall be designed to enable setting movements to be undertaken
from the outside of the closed guard(s) and the following requirements shall be met:
 An operating mode selector shall be provided that can be locked in the set-up mode with a
removable key. The selector shall be hardwired and/or meet the required performance level
based on a risk assessment and monitored to ensure proper operations.
 The key for the mode selector shall only be issued to person(s) trained in set-up operations.
 Hazardous movement/motions required for set-up shall only be possible by means of a hold-
to-run control device.
 When a hold-to-run control device is fitted on a portable control unit, it shall be capable of
being taken into the point of operation. An enabling device and an additional emergency
stopping device shall be fitted on such a control unit. The emergency stopping device shall
act on all hazardous movements associated with the set-up operations.
 When a hold-to-run control device is not on a portable unit, it shall be permanently fixed in
such a position that the set-up person has a clear view of the point of operation.
 A hold-to-run control device shall only be operable when the mode selector device is on the
set-up mode.
 The set-up speeds shall be designed not to exceed 25 mm/second (1 inch/second).
 A pneumatic drive for the setting movements that create a hazard shall not be permitted to
function in set-up mode.
Valves that could override set-up restrictions through activation by hand or tool shall be made
inaccessible (i.e., guarding).
94
Annex P Alternative Risk Reduction Measures for the Printing Industry

(from clause 8.1)
(Informative)
In the printing industry, many routine and repetitive, minor servicing tasks need to be done with
machine motion. The industry has developed a methodology employing a combination of
engineered safeguards, warning devices, procedures and safe work practices to provide
effective alternative protection to lockout or tagout. The method is known in the industry as the
inch-safe-service method.
Printing presses and other large equipment in the printing and binding industries such as saddle
or perfect binding systems are equipped with control stations containing, at a minimum, a
stop/safe, stop/safe/ready pushbutton or equivalent E-stop pushbutton. Motion control stations
also include an inch button that enables slow machine motion while the button is held down.
These control stations are electrically linked to an audible or area light warning system that
provides an audible and/or visual indication of the machine’s state and impending motion. For a
complete description of the safety systems used in printing press and bindery and finishing
systems, see ANSI B65.1 through B65.3. The inch-safe-service procedure is employed by
personnel who operate the equipment and in combination with the stop/safe control, warning
system and guards, provides effective alternative protection.
Inch-Safe-Service Procedure
 Before any minor servicing is performed, the machine is stopped and a stop/safe,
stop/safe/ready or equivalent E-stop pushbutton is activated.
 Servicing is performed with the machine in a safe condition.
 The stop/safe is released/unlatched. The inch (or reverse) pushbutton is then activated
which starts an audible alarm that warns of impending machine motion.
 After a signal and delay, the machine moves, while the inch (or reverse) button is
depressed.
 The stop/safe or equivalent E-stop pushbutton is depressed and minor servicing is again
performed.
 The process is repeated as many times as necessary.
95
Annex Q Alternative Risk Reduction Measure for Robotic Applications

(from clause 8.1)
(Informative)
Robotic applications present the unique combination of a dynamic workspace for the machine
as well as specific process hazards. Personnel can be exposed to hazardous energy in a
number of routine actions such as teaching, servicing, minor tool changes, removing jams and
troubleshooting. Provisions for effective alternate control of hazardous energy in robotic
applications are contained in ANSI/RIA R15.06, Industrial Robot and Robot Systems – Safety
Requirements.
When access to the safeguarded space of a robot system is necessary while power is available,
alternate safeguards or procedures are established and used to prevent harm. All are based on
the premise that the personnel performing tasks have total control of the robot system including
all peripheral equipment and process hazards.
Alternative protection methods for a typical task may include:
 disabling the automatic task program;
 isolating the hazardous energy to the drive motors;
 use of motion enabling devices for each person entering safeguarded space;
 emergency stop circuit remains functional;
 and additionally, certain tasks can be performed by placing the robot system in a
predetermined position which is safety rated, or by using devices such as blocks/pins to
prevent potentially hazardous motion of the robot systems.
96
Annex R Alternative Risk Reduction Measures in the Steel Making Industry

(from clause 8.1)
(Informative)
In the steel making industry, several tasks need to be completed on stacker transfer tables that
move individual steel bars (including rounds, flats and angles). These tasks involve personnel
entering into the transfer table to perform tasks such as tagging bundles, quality inspection,
unjamming or straightening steel, etc. One such work area is shown below.
Figure R.1 – Tagging area work station, lockout point and

transfer table (to right)
Past practice required employees to lockout the transfer table prior to performing the bundle
tagging task. Figure R.2 shows equipment used for the bundling task.
97
Figure R.2 – Equipment used to tag bundled steel bars, angles

and flats
Lockout was required under a strict interpretation of OSHA’s 29 CFR 1910.147 (citations had
been issued). The frequency of these tasks resulted in the knife switches failing on a regular
basis, exposing employees to arc flash and other hazards.
The industry has developed an alternative method that employs a combination of engineered
safeguards, warning devices, procedures and safe work practices to provide effective
alternative protection to lockout or tagout. As shown in Figure R.3, a light curtain disables the
table drives when personnel cross onto the transfer table. The area is marked with an
awareness barrier (red line). Safe work practices are followed to limit access to only those
employees who have been appropriately trained of the hazards in this work area and the proper
procedures to be followed to avoid them. Additionally, documented safe work procedure prohibit
the restart of the transfer table if an employee is on the working side of the light curtain. The
restart control is in direct line of sight of the work area.
98
Figure R.3 – Transfer table using alternative method in lieu

of lockout
99
Annex S Application of this Standard to the Semiconductor Industry

(from clause 8.1)
(Informative)
S1. Introduction
Semiconductor manufacturing uses various types of process and metrology equipment, most of
which use more than one type of hazardous energy. By consensus of the suppliers and users of this
equipment, the industry relies primarily on SEMI S2 and other documents in the SEMI standards “S”
series to guide the safe design of equipment. The EU’s Machinery Directive Annex I criteria are
usually also applied, as are criteria derived from an understanding of various workplace safety
criteria, such as the US OSHA lockout requirements. The industry has a very strong safety record
which demonstrates the effectiveness of the control of hazardous energy (CoHE) design
methodologies it uses. (Although the terms “CoHE” and “lockout” are often confused, CoHE is
broader than lockout. CoHE includes alternative methods that are used with, or instead of, lockout to
manage the risks both of unexpected startup and of contact with hazardous energy sources.)
Providing CoHE for maintenance and service tasks presents a couple of challenges that are not
addressed by lockout:
 There are some maintenance and service tasks that require hazardous energy to be present.
 There are hazardous energies that present risks that lockout does not address well.
This annex has been provided to show how and why the semiconductor equipment industry uses
both lockout and alternative methods to provide CoHE during maintenance and service.
S.1.1 Because the control of even the smallest particles is key to successful yields, the fabs in which
semiconductors are fabricated are cleanrooms. As the costs of constructing and operating fabs are
high, many of the supporting modules (which distribute multiple hazardous energies) of the
equipment are located in subfabs, the floors directly below the fabs. Subfabs are usually not
cleanrooms or are cleanrooms of less stringent controls, so they are less expensive to construct and
operate.
S.1.2 The hazardous energies in the semiconductor industry include:
 distributed electrical (hazardous voltages, high currents)
 gravitational energy (e.g. suspended, hinged loads)
 stored electrical (capacitors, batteries)
 kinetic energy (moving robots, linear drives, gears, doors)
 pressurized liquids (hydraulic, pumped)
 thermal/cryogenic energy (hot, cold temperatures)
 compressed gases (liquefied or pressurized)
 chemical energy (heat of reaction, fire, explosion)
 electromagnetic radiation (x-ray, RF, IR, UV, lasers)
 stored mechanical energy (springs, elastic seals)
 magnetic fields (permanent magnets and electromagnets)
S.1.3 Each of these hazardous energies can lead to harm to personnel, as well as significant
equipment, facility and environmental damages. The semiconductor industry, however, is very highly
automated, so very few worker tasks are required during production uptime. Most human interaction
with the equipment occurs during scheduled or unscheduled downtime. When any situation requiring
worker intervention occurs, the equipment must be placed in a safe state to prevent unexpected
startup or re-energization.
100
S.1.4 Lockout, Alternative Methods or Both

When isolation of the hazardous energy would prohibit the completion of certain tasks, using
alternative methods is an allowed means of protecting the workers. In these special cases, the use
of robust control circuit designs can provide a highly-reliable engineered solution to control these
hazardous energies. The semiconductor industry has adopted these functional safety design
approaches (e.g., control reliability) when hazardous energies are required for certain specific tasks
(e.g., teaching wafer handlers) or tasks allowed by the OSHA infrequent minor service exemption
during normal production (e.g., changing pads on a chemical mechanical polishing system).
S.1.4.1 Lockout should be used if it does not prevent performing a given maintenance or service
task and if it reduces the risk to personnel that results from the hazardous energy. An example of
this is locking out the power to a wafer handler motor while removing a broken wafer from a transfer
chamber.
S.1.4.2 If isolation of the hazardous energy would prevent performing a task, only alternative
methods should be used. An example of a task that cannot be done when related hazardous energy
is isolated is adjusting the path of the wafer handler, which can be done only if the wafer handler is
capable of powered motion.
S.1.4.3 In some cases, however, lockout does not prevent performing the task and does reduce the
risk, but not to an acceptable level. In such a case, both lockout and alternative method(s) should be
used. An example of this is a wafer chuck that is heated by an electrical resistance element and is at
1000ºC. One needs to lockout the power to the heaters, but the thermal energy stored in the
heaters, chuck and surrounding parts poses an unacceptable burn hazard until the parts have
cooled. An alternative method needs to be used to protect workers from that hazard.
S.1.5 More detail about control of hazardous energy in the semiconductor industry is located in
SEMI S2 and in a SEMI white paper located on the SEMI website.
S.2 Lockout
S.2.1 The semiconductor industry operates globally. Only ~20% of the equipment is used in the U.S.
The rest is used outside the U.S. and, in these other regions (Europe, Asia, etc.), many jurisdictions
allow the use of properly designed remote lockout (with adequate features, based on risk
assessment, such as control reliability and redundancy) to prevent the unexpected start-up or re-
energization during service and maintenance tasks.
S.2.2 Within the U.S., when a hazardous energy is not required during a service or maintenance
task, the semiconductor industry employers must follow OSHA’s lockout requirements. The lockout
procedures for service and maintenance tasks can be very complex. Entire wafer processing
equipment is shut down completely only infrequently. To maximize throughput, semiconductor
equipment is usually modular, so that one process chamber can be shut down for maintenance or
service while the other process chambers remain up and running. Performing lockout on a single
process chamber, using the required energy-isolating devices, commonly requires the worker to
prepare that process chamber for lockout, then leave the fab to go downstairs to the subfab to
activate and lock the (on average, five) energy-isolating devices on the equipment’s
subsystem/support module(s). The worker must then return to the fab and verify isolation of the
hazardous energies and a safe energy state.
S.2.3 Once isolation and safe energy state are verified at the fab level, the worker can perform the
maintenance or service task. After the task is completed, the worker(s) must exit the fab, de-gown
again, go back downstairs to remove their personal locks within the subfab. They must then regown,
re-enter the fab, and restart the equipment. If the situation is not corrected on the first attempt, the
entire lockout process has to be repeated until the situation is corrected.
101
S.2.4 As semiconductor fabs usually install many pieces of like equipment side by side, the worker
must be careful to identify and manage the hazardous energies of the correct one. The risk of having
locked out the wrong equipment is managed by the verification step.
S.2.5 In the simplest case, lockout for a maintenance or service task in the fab requires two
degownings, two gownings and four moves between building levels. Typically, each degowning and
each regowning includes two layers of shoe covering; two layers of head covering; at least one layer
of face covering; one layer covering the torso, arms and legs; and at least one pair of gloves.
S.2.6 Furthermore, there are some systems in which hazardous energies must be managed
stepwise. Consider, for example, the case of a piece of chemical process equipment in which the
supplies of hazardous production materials (HPMs) must be isolated, but other hazardous energy
sources, such as electrical power and purge fluids, must be used for removal of the residual HPMs.
Such a case requires three degownings, three gownings and six moves between building levels:
• Prepare • Verify removal of Fab

equipment hazardous energies
for work and • Perform work
for removal • Remove • Prepare equipment
of hazardous residual for restoration of • Restart
energies HPMs hazardous energies equipment
Regown Regown Gowning &

Regown Degowning
Degown Degown Degown Areas
Main Level
Ascend
Ascend
Ascend
Lower Level
• Actuate HPM • Actuate remaining • Remove locks Subfab

isolation devices hazardous energy and tags
Descend • Apply locks and isolation devices Descend • De-actuate
Descend
tags • Apply locks and tags hazardous energy
• Remove residual isolation devices
hazardous energy
Figure S.1 – Example of travel necessitated by use of direct lockout.
S.2.7 While these lockout steps are straightforward, and can be followed in sequence successfully,
they are tedious and prone to human error. Requiring work on multiple levels, with several energy
sources, and adjacent similar pieces of equipment increases the risk of human error.
S.2.8 Outside the U.S., employers are permitted to prevent unexpected energization of the
equipment using remote lockout, as described in Annex B, instead of the direct lockout approach
required by OSHA, to prevent the unexpected starting of the equipment. An advantage of allowing
such remote lockout methods is that workers are able to perform lockout from within the fab where
the maintenance and service is to be performed. This reduces the time and effort required to protect
the workers and reduces the risk of human error, such as performing lockout on the wrong piece of
equipment. This remote lockout approach has been used with much success throughout the world.
S.3 Alternative Methods
S.3.1 Alternative methods are used in semiconductor manufacturing equipment in the following
ways:
102
S.3.1.1 When lockout alone cannot reduce the risk sufficiently, alternative methods are used
supplementally to reduce the risk to an acceptable level. Typically, such situations arise when
lockout can prevent the addition of hazardous energy, but not remove the residual energy. For
example:
 Locking out power to a resistance heater prevents additional heating, but the heated object may
have enough thermal energy, and dissipate that thermal energy slowly enough, that the object
presents a burn hazard for several hours after power is removed. In such cases, barriers are
provided to prevent incidental contact and are labeled with the nature of the hazard, the possible
injury, and the instruction not to defeat or remove the barrier until the temperature is low enough.
 Locking out chemical supply lines prevents additional hazard material delivery to the point to be
accessed, but it does not remove any of the hazardous residue. Depending on the residue or the
equipment, remotely-controlled or manual decontamination procedures are required. If the
decontamination procedure requires access to contaminated portions of the equipment, PPE is
specified. In some cases, supplemental exhaust ventilation is provided to reduce the risk of
exposure to airborne substances.
S.3.1.2 When isolating the hazardous energy would prevent performance of a task, alternative
methods are used instead of lockout. For example, teaching an automated wafer handler its paths
and endpoints often requires having access to its working space. If the power to the wafer handler’s
motors were locked out, the wafer handler could not be stepped through its path. The risk of injury to
the personnel teaching is reduced by having an interlock on the accessway to that working space
that disables normal operation of the wafer handler, but allows it to have powered motion, at reduced
speed or force, only when a hold-to-run button on teaching pendant is actuated.
S.3.1.3 Alternative methods are also used as means of risk reduction for tasks for which lockout is
not required. For example:
 A chemical process chamber typically has electro-mechanical sensors to ensure that the various
means of access are closed. If the chemical process is performed at vacuum, a pressure switch
is often used to ensure that the desired pressure has been reached, and that pressure cannot be
reached if the accessway is open. If these sensors do not indicate that the interior of the process
chamber is suitably isolated from the environment, hazardous materials are not delivered to the
process chamber.
 Control components, such as valves and mass flow controllers, for toxic, flammable and
corrosive process materials are within enclosures that have monitored exhaust ventilation.
 Electrical connectors for hazardous voltage and power are touch-safe, at least on the side from
which power is supplied.
For more information about the Control of Hazardous Energies within the semiconductor industry,
please refer to link: http://www.semi.org/en/semi-2016-white-paper-cohe-loto
103
Annex T Alternative Risk Reduction Measures involving Trapped Key Interlock

Systems
(from clause 8.2.9 and Annex H)
(Informative)
Example 1: Alternative Risk Reduction Measures of Control for Machines/Equipment with
Run Down Time
Many machines still pose a hazard even after energy sources have been isolated due to
residual motion. Examples of this type of equipment are flywheels and machines with heavy
components that take time to cease motion.
A trapped key safety interlocking system incorporating a time delay feature will reduce the risk
of this hazard. It can be used to prohibit entry until all residual motion is either eliminated or at a
significantly reduced level.
Depending upon the application, there are several types of time delay units that could be
incorporated these are:
 Mechanical Time Delay – with this type of system, there is a mechanical timer which can
be set to incorporate the run down time prior to releasing the key.
 Electronic Time Delay – with this type of system, there is an electronic device which can be
set to incorporate the run down time prior to releasing the key.
 Voltage Sensing Unit – with this type of system, motion is sensed by the use of a back emf
unit which monitors the voltage on the motor winding due to its rotation. When the voltage
reaches zero, all motion has stopped and the key is released.
Whichever time delay unit is used, the methodology is the same.
Below is an example of this type of system.
Figure T.1 – Trapped Key System Incorporating a Time-Delay Unit
1. Initiate a controlled stop of the machine/equipment/process. Once the allotted time has
elapsed, (if using a mechanical or electronic timer) the system will the release Key A. In the
case of a back emf unit Key A will only be released once all residual energy has been
stopped.
2. Remove Key A from the delay unit, this will isolate the control power to the system.
104
3. Insert Key A into mechanical exchange unit and turn. This will allow Key(s) B to be
removed from the exchange unit. Once a Key B has been removed, then Key A will
become trapped and cannot be removed until all Key B are returned to the exchange unit.
4. Insert Key B into mechanical guard door lock and rotate key. This will allow door to be
opened. Once door is opened, Key B becomes trapped in the lock. In the case of full body
access, it is recommended that a dual key door interlock is used. This works by inserting
Key B in the lock and removing Key C. The Key C will then be taken inside the cell with the
operator, this ensures that the operator cannot be locked inside the cell. In the case of
multiple operators, then extra Key C modules can be added to the mechanical guard door
interlock to ensure each person entering the cell has their own key allowing personal control
of the environment.
5. To restart the machine, reverse the above process.
Example 2: Alternative Risk Reduction Measures for Mains Isolation for

Machines/Equipment.
In some instances, it is not enough to isolate a machine prior to opening up the machine.
Instead it is required that a full power isolation method be carried out. When a machine is
utilizing trapped key technology on its gates, it is also a requirement that the isolation key be
used in the system to allow the doors to be opened. In these cases, it would be prudent to use
the trapped key as an enhancement to the existing LOTO procedure.
Depending upon the rating and size of the mains isolation unit, there are several types of
trapped key methods that could be incorporated these are:
 Directly driving the contacts via a trapped key fitted to the shaft (see Figure T.2). This
method would work on units that are small enough to allow the trapped key to drive directly.
 Having a cam mechanism and bolt lock module (see Figure T.3) for units that are too large
for the trapped key to directly drive.
Figure T.2 – Directly Driven Isolator Figure T.3 – Cam and Bolt Lock
Whichever method is used, the basic principles will remain the same.
Below is an example of this type of system incorporating a directly driven isolator:
105
Figure T.4 – Trapped Key Mains Isolation System
1. Remove Key A. from the mains isolation switch, this will isolate power to the machine. Once
Key A is removed a lockable dust cover will engage. Put padlock on dustcover to lock out
mains power.
of the environment.
The only difference between the two styles would happen in Step 1. For a larger disconnect, the
method would be:
Figure T.5 – Diagram of larger disconnect
106
1. Isolate the mains by throwing the disconnect switch. This will allow the cam to be engaged
by the mechanical bolt lock mechanism. Remove Key A. from the mechanical bolt lock, this
will drive the mechanical bolt into the cam mechanism. The mechanical bolt will then inhibit
movement of the disconnect arm. Once key is removed, the lockable dust cover will engage.
Put a lock on the dustcover to lock out mains power isolation switch.
removed from the exchange box. Once a Key B has been removed, then Key A will
become trapped and cannot be removed.
of the environment.
107
Annex U Description of Risk Reduction Measures

(per clause 8.1.2)
(Informative)
The following descriptions are general and intended for new readers. Some of these devices
have special limitations as to their application. See ANSI B11.19 for a more detailed description
and use of risk reduction measures. This annex is informative, but the text in this annex includes
“shall” statements that are contained in the ANSI B11.19 standard.
Area Scanners. These devices detect objects or persons entering the sensing field (hazardous
area). Their application is typically indicated for covering large or irregularly shaped areas.
Guards. For the purpose of this standard, there are two types of guards, fixed and movable.
Guards that do not have to be opened frequently are fixed in such a way that their removal
necessitates the use of tools. Movable guards are typically interlocked. Guards shall not create
any additional hazards to personnel.
Enabling (Hold-to-Run) Devices. These devices require the person to apply continuous
actuation. The device is connected to a safety control system. These devices only protect the
person using the device, and multiple devices may be used together to provide protection for
each person.
NOTE: Three position (center enable) devices offer additional protection to the holder by
removing the on signal to the control if the device is released or fully compressed.
Presence Sensing Devices. These devices create a sensing plane. The sensing plane is
comprised of one or more transmitting elements and one or more receiving elements. When an
object or person interrupts one or more beams, the device sends a signal to the control circuit.
NOTE: Examples include light curtains, safety scanners, safety beams.
Pressure Sensitive Devices. Pressure sensitive devices are used to detect the presence of a
person or object. When pressure is applied to the device, a signal is sent to the control circuit.
NOTE: Examples include safety mat and safety edge/bumper systems.
Safety-Rated Switches. These are devices that are tamper resistant and mechanically
actuated with positively driven multiple contacts. Magnetic switches may comply if they are
coded and have monitored contacts.
Stop Devices/Emergency Stop Devices. These devices are usually pushbuttons, ropes/
cables, footswitches, rods or pushbars that activate a stop command when the device is
activated.
Trapped Key Systems. These devices can be mechanically linked to power circuits, switches,
valves and access points, and can require operators to follow a predetermined sequence of
actions. Examples of trapped key use are contained in Annex U.
Warning and Alerting Techniques. Warning and alerting techniques include, but are not
limited to, the following:
 Attendant. An attendant may be used to warn exposed personnel or monitor the
effectiveness of the applied safeguard.
 Automated Warning Systems. Audible or visual devices are used individually or in
combination to warn personnel of potentially hazardous conditions.
 Barricades. Barricades are used to prevent access to a hazardous area, and may be used
in conjunction with warning signs.
108
 Warning Signs and Tags. Warning signs, symbols or tags are used to warn personnel
where hazards exist.
Administrative Controls (Safe Work Procedures and Practices).
Administrative controls include, but are not limited to:
 Apparel. Loose or other inappropriate clothing, long hair or alternative items that may
contact moving machinery should not be allowed. Exposed conductive articles of jewelry
and clothing, including metalized aprons, cloth with conductive thread or metal headgear,
should not be worn where they present an electrical contact hazard.
 Illumination. Adequate illumination shall be available for the task to be performed.
 Preparation for Work. All authorized persons involved with the task or activity, prior to
starting the work, shall review existing hazards, written practices, documented alternative
risk reduction measure(s) and control measures to be used.
 Training. Training on the use of alternative risk reduction measures shall be conducted in
accordance with 5.3.2.
Personal Protective Equipment (PPE). PPE includes, but is not limited to:
 safety glasses/goggles/face shields
 gloves
 safety footwear
 hearing protection
 respirators
 head protection
109
Annex V Control System Example Methodologies

(per clause 8.3.2)
(Informative)
This annex provides a general overview of control systems for readers new to the topic. See
resources cited in this standard for further information.
If the risk assessment for the machine, equipment or process identifies a risk reduction measure
that requires a control system, then a design specification for the control system must be
identified in order to achieve the appropriate safety performance (risk reduction). There are
different methods for determining control system performance as noted below.
Categories EN 954-1
EN 954-1 (1996) and later ISO 13849-1 (1999) introduced categories (B, 1-4) that provide the
structure or architecture for control circuits. As the category level increases, the required
architecture and resultant reliability also increases – from single channel (a simple circuit),
redundancy (two switches and/or two wires), monitoring (such as an indicator light) and self-
checking (active testing to ensure operational).
ISO 13849-1 defines category as follows:
category
classification of the safety-related parts of a control system in respect of their resistance
to faults and their subsequent behaviour in the fault condition, and which is achieved by
the structural arrangement of the parts, fault detection and/or by their reliability
Guidance on the selection of categories is contained in Figure V.1 below.
110
Figure V.1 – Possible selection of categories for safety-related

parts of control systems in ISO 13849-1 (1999).
111
The description of categories is shown below in Table V-1.

Table V-1 – Categories according to ISO 13849-1 (1999)
Category Summary of Requirements System Behavior

SRP/CS and/or their protective equipment, The occurrence of a fault can lead
as well as their components, shall be to the loss of the safety function.
designed, constructed, selected, assembled
B and combined in accordance with relevant
standards so that they can withstand the
expected influence. Basic safety principles
shall be used.
Requirements of B shall apply. Well-tried The occurrence of a fault can lead
components and well-tried safety principles to the loss of the safety function
1
shall be used. but the probability of occurrence is
lower than for category B.
Requirements of B and the use of well-tried The occurrence of a fault can lead
safety principles shall apply. to the loss of the safety function
between the checks.
2
Safety function shall be checked at suitable
intervals by the machine control system The loss of the safety function is
detected by the check.
Requirements of B and the use of well-tried When a single fault occurs, the
safety principles shall apply. safety function is always
performed.
Some, but not all, faults will be

3
detected.
Accumulation of undetected faults

can lead to the loss of the safety
function
Requirements of B and the use of well-tried When a single fault occurs the
safety principles shall apply. safety function is always
performed.
Safety-related parts shall be designed so
that: Detection of accumulated faults
reduces the probability of the loss
⎯ a single fault in any of these parts does of the safety function (high DC).
4 not lead to a loss of the safety function;
and The faults will be detected in time
⎯ a single fault is detected at or before the to prevent the loss of the safety
next demand upon the safety function, function.
but that if this detection is not possible,
an accumulation of undetected faults
shall not lead to the loss of the safety
function.
112
Performance Levels ISO 13849-1

In 2006, ISO 13849-1 introduced a probabilistic determination of potential control system
failures. The introduction to the now 2015 standard includes the following:
The ability of safety-related parts of control systems to perform a safety function under
foreseeable conditions is allocated one of five levels, called performance levels (PL).
These performance levels are defined in terms of probability of dangerous failure per
hour.
The standard uses performance levels as the metric used to discuss control systems (see
Figure V.2).
Figure V.2 – Risk Graph for Determining Required PLr for Safety Function
The general approach of ISO 13849-1 is to design the safety-related parts of the control system
(SRP/CS) by:
1. defining a safety function
2. determining a design specification (required category or performance level) for the control
system
3. using good engineering principles to design the control system
4. evaluating if the control system meets the design specification based on the system design
and the components used.
The focus of ISO 13849-1 is to provide guidance on these steps.
The sole use of categories limits the maximum level of reliability that can be achieved. The use
of performance levels can allow for a higher maximum level of reliability using a less reliable
architecture structure if appropriate components and design measures are applied. This
provides the incentive to consider making the reliability calculations for performance levels. A
lower level of architecture can be justified by the calculations which demonstrate the sufficient
level of reliability. This can, in some cases, represent a significant cost savings which makes the
calculations very worthwhile.
113
Using Risk to Determine a Control System Specification

Risk assessment for a machine, equipment or process can be evaluated using a risk scoring
system such as shown below in Table V-2 (there are many different risk scoring systems).
Table V-2 – Example Risk Scoring System
(from ANSI B11.0)
Severity of Harm
Probability of
Catastrophic Serious Moderate Minor
Occurrence of Harm
Very Likely High High High Medium
Likely High High Medium Low
Unlikely Medium Medium Low Negligible
Remote Low Low Negligible Negligible
Based on the risk level derived from the risk assessment for the machine, equipment or
process, an appropriate design specification for a control system can be obtained from
Table V-3.
114
Table V-3 – Typical Design Strategies to Address Control Circuit Reliability
Severity /
Risk Components Architecture/Structure Comments
Exposure
Negligible Low / Well-tried Single channel mechanically or
Infrequent industrial Category 1 electro-
rated mechanically
isolates the
incoming power
from the motor,
solenoid or other
actuating device
that produces
hazardous motion.
Low Low / Industrial Dual channel mechanically or
Frequent rated Category 2 electro-
mechanically
isolates the power
and is inspected as
part of normal
operations to
ensure integrity of
the system
Medium Serious / Industrial Dual channel (one of which These systems
Any rated is hardwired) typically have
redundant interlock
Self-checking or monitored switch safety
through the use of a safety contacts, redundant
relay or safety (multiple isolation through
channel) PLCs to ensure positively guided
integrity and performance of electro-mechanical
the control circuits relays, and are
monitored or self-
Category 2 or 3 checking through
use of a safety
interface module or
safety PLC that is
designed and
installed to a high
level of integrity
through the
selection of robust
components.
NOTE: Single
Channel general
purpose PLCs do
not satisfy this
requirement.
115
High Catastrophic Industrial A control reliable dual This system shall

/ Any rated channel hardwired circuit of be designed to
industrially-rated ensure protection
components that satisfies equivalent to a
the design features as mechanical
specified in ANSI B11.19 disconnect switch
(with redundant door or master shut-off
interlock switches etc.), valve.
using a safety interface
module or safety PLC to NOTE: Under all
ensure integrity and circumstances, the
performance of the person shall have
safeguarding system. exclusive personal
control over the
Category 3 or 4 means to maintain
the state of the
control circuit in a
protective mode.
Examples include
personnel safety
keys or other
locking devices.
NOTE: For more detailed information on control circuit safety performance, see ANSI
B11.26, ISO 13849-1, ANSI B11.19, NFPA 79 and other sources.
116
Annex W Alternative Risk Reduction Measures for Freeze Plug Applications

(from clause 8.4.2)
(Informative)
Freeze plug or stop technology, used successfully for many years in the industry, provides a
non-intrusive method for the isolation of piping systems. Line freezing requires no permanent
modification or welding on the piping system. It can be used as a secondary isolation seal for
additional protection. Piping systems containing water, hydrocarbons and any chemical with a
suitable freeze point and no flow can be isolated with freeze plug methods.
Pipe freezing applications make possible the replacement, repair or addition of valves; isolation
of work zones; avoidance of drain downs; and maintaining the integrity of critical systems and
system operating pressures.
In addition to developing procedures in compliance with the provisions of clause 5.5, the user
shall ensure that personnel involved in applying the freeze plug and those potentially exposed
performing the servicing or maintenance comply with the following:
 An attendant will remain at the freeze point(s) at all times while authorized persons are
exposed to possible contact with any liquids contained in the piping system.
 Cryogenic supply systems shall be equipped with low level warning alarms. An adequate
cryogenic supply shall be on hand which is sufficient for the duration of the work.
 Exposed authorized persons shall attach personal tags or locks at the freeze point(s) to
indicate their presence and prohibit the cessation of the freeze prior to any removal by those
attaching the complementary devices.
 Personnel applying the freeze shall immediately communicate to the exposed authorized
persons any change of conditions that might place them at risk.
 If the authorized persons performing the maintenance work are out of sight of the personnel
responsible for the application and continuity of the freeze, a means of effective
communication shall be established.
 If the area of the freeze application is an enclosed or confined space, precludes reasonable
air changes or is substantially obstructed, continuous oxygen monitoring shall be conducted
and adequate ventilation or supplemental oxygen provided.
 Protective practices shall be utilized to safeguard personnel during a planned release or
unplanned ejection of the plug.
117
Bibliography
(Informative)
ANSI A13.1, Scheme for the Identification of Piping Systems
ANSI/ASSE Z10, Occupational Health & Safety Management Systems
ANSI/ASME B31 Series, Piping Systems
ANSI/ASSE Z490.1, Accepted Practices in Safety, Health and Environmental Training
ANSI B11 Series, Machine Safety Standards
ANSI B11.0, Safety of Machinery
ANSI B11.19, Performance Criteria for Safeguarding
ANSI B11.26, Functional Safety of Equipment (Electrical/Fluid Power controls systems)-
Application of ISO 13849 General Principles for Design (pending)
ANSI B11-TR3, Risk Assessment and Risk Reduction – A Guide to Estimate, Evaluate and
Reduce Risks Associated with Machine Tools
ANSI B65.1, Graphic technology – Safety requirements for graphic technology equipment and
systems – Part 1: General requirements
systems – Part 2: Prepress and press equipment and systems
systems – d Part 3: Binding and finishing equipment and systems
ANSI B151 Series, Plastics Machinery Safety Standards
ANSI/ISO 12100:2010 (ISO 12100:2010 IDT), Safety of machinery – General principles for
design – Risk assessment and risk reduction
ANSI, National Electrical Safety Code, NESC C-2. Published by the IEEE.
ANSI/PMMI B155.1, Safety Requirements for Packaging Equipment
ANSI/RIA R15.06, Industrial Robots and Robot Systems - Safety Requirements
ANSI/SPI B151.1, Safety Requirements for the Manufacture and Use of Injection Molding
Machines
ANSI/SPI B151.31, Safety Requirements for the Manufacture and Use of Blow Molding
Machines
ANSI/UL 6420, Equipment Used for System Isolation and Rated as a Single Unit
ANSI Z21.22, Relief Valves for Hot Water Supply Systems
ANSI Z241.1, Safety requirements for sand preparation, molding and core making in the sand
foundry industry
Grund, E.V. (1995). Lockout/Tagout: The process of controlling hazardous energy. National
Safety Council. www.nsc.org
IEC 60204-1:2005, Safety of machinery — Electrical equipment of machines – Part 1: General
ISO 13849-1:2015, Safety of machinery – Safety-related parts of control systems – Part 1:
General principles for design
118
ISO 14118:2008, Safety of Machinery – Prevention of Unexpected Start-up

ISO 14119:2013, Safety of machinery – Interlocking devices associated with guards
ISO/TR 14121-2:2012, Safety of machinery – Risk assessment – Part 2: Practical guidance and
examples of methods
Main, B. and Grund, E. (2016) The Battle for the Control of Hazardous Energy, design safety
engineering, inc. www.designsafe.com
MIL STD-882E: 2012, System Safety Principles for design and selection
NFPA 79 Edition: 2015, Electrical Standard for Industrial Machinery
NFPA 70E Edition: 2015, Standard for Electrical Safety in the Workplace requirements
Title 29 CFR 1910.144 (OSHA), Safety color code for marking physical hazards
Title 29 CFR 1910.145 (OSHA), Specifications for accident prevention signs and tags
Title 29 CFR 1910.147 (OSHA), The control of hazardous energy (lockout/tagout)
Title 29 CFR 1910 Subpart O (§211-219) (OSHA), Machinery & Machine Guarding
Copies of this American National Standard, Z244.1, may be purchased from the American
Society of Safety Engineers by phoning (847) 699-2929 or visiting the American Society of
Safety Engineers website at www.asse.org.
119
END USER LICENSE AGREEMENT
IMPORTANT - READ CAREFULLY BEFORE DOWNLOADING OR COPYING TO YOUR

COMPUTER ANYFILE(S) CONTAINED HEREWITH. THE STANDARD(S) AND OTHER
INFORMATION PROVIDED HEREWITH ARE COPYRIGHTED. BY DOWNLOADING ANY FILE
PROVIDED HEREWITH TO YOUR COMPUTER, YOU ARE ACCEPTING AND AGREEING TO
THE TERMS OF THIS LICENSE AGREEMENT. IF YOU ARE NOT WILLING TO BE BOUND BY
THE TERMS OF THIS LICENSE AGREEMENT, PRIOR TO DOWNLOADING OR COPYING TO
YOUR COMPUTER ANY FILES(S), YOU MUST DECLINE ACCESS TO SUCH MATERIALS.
1. GRANT OF LICENSE: Subject to the provisions contained herein and to the payment of all
applicable fees, the American Society of Safety Engineers (ASSE) grants you a nonexclusive, non-
transferable license to the materials contained herewith (the "Product"). Your licensed rights to the
Product are limited to the following:
(a) This License Agreement does not convey to you an interest in or to the Product, but only a limited
right of use revocable in accordance with the terms of this License Agreement.
(b) You may install one copy of the Product on, and permit access to it by, a single computer owned,
leased or otherwise controlled by you. In the event that computer becomes dysfunctional, such that you
are unable to access the Product, you may transfer the Product to another computer, provided that the
Product is removed from the computer from which it is transferred and the use of the Product on the
replacement computer otherwise complies with the terms of this Agreement. Neither concurrent use on
two or more computers nor use in a local area network or other network is permitted. You shall not
merge, adapt, translate, modify, rent, lease, sell, sublicense, assign, loan or give to or otherwise transfer
any of the Product, or copies thereof, or remove any proprietary notice or label appearing on any of the
Product to any individual or entity for any reason or purpose. You may copy the Product only for backup
purposes.
(c) You acknowledge and agree that the Product is proprietary to the Copyright holder (the "Owner")
identified on the front page of the Product, and is protected under U.S. copyright law and international
copyright treaties. You further acknowledge and agree that all right, title and interest in and to the
Product, including all intellectual property rights, are and shall remain entirely with the Owner.
(d) You shall provide ASSE or any designee of ASSE with all information necessary to assure
compliance with the terms of this Agreement. In the event you are not in compliance with the terms of
this Agreement through the actions of unrelated third parties, you shall use your best efforts to cooperate
with ASSE and any of its designees to assure compliance.
2. LIMITED WARRANTY:
(a) ASSE warrants for your benefit alone that, unless disclosed in the Product to the contrary, ASSE and
the Owner can license the Product and all copyright and trademarks related thereto or therein.
(b) THE EXPRESS WARRANTIES SET FORTH IN THIS SECTION 2 CONSTITUTE THE ONLY
WARRANTIES WITH RESPECT TO THE PRODUCT AND ASSE AND THE OWNER MAKE NO
OTHER REPRESENTATION OR WARRANTY OR CONDITION OF ANY KIND, WHETHER
EXPRESS OR IMPLIED (EITHER IN FACT OR BY OPERATION OF LAW) WITH RESPECT TO
ANY OF THE PRODUCT, INCLUDING, WITHOUT LIMITATION, WITH RESPECT TO THE
SUFFICIENCY, ACCURACY OR UTILIZATION OF, OR ANY INFORMATION OR OPINION
CONTAINED OR REFLECTED IN, ANY OF THE PRODUCT. ASSE AND THE OWNER
EXPRESSLY DISCLAIMS ALL WARRANTIES OR CONDITIONS OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE. NO OFFICER, DIRECTOR, EMPLOYEE, MEMBER,
AGENT, CONSULTANT, CONTRACTOR, REPRESENTATIVE OR PUBLISHER OF THE
COPYRIGHT HOLDER IS AUTHORIZED TO MAKE ANY MODIFICATION, EXTENSION, OR
ADDITION TO THIS LIMITED WARRANTY.
3. INDEMNIFICATION:
The Owner, ASSE, any agent, representative, publisher or distributor of the Product, or any of their
respective directors, officers, employees, agents, representatives or members (the “ASSE and Owner
Indemnified Parties”) shall have no liability for, and you shall defend, indemnify and hold each of the
ASSE and Owner Indemnified Parties harmless from and against, any claim, loss, demand, liability,
obligation and expenses (including reasonable attorneys' fees) based upon or arising out of any injury or
damage, or any product liability claim, including but not limited to, any personal or bodily injury or
property damage, arising out of, pertaining to, or resulting in any way from, the use or possession of any
of the Product by you and/or any of your directors, officers, employees, representatives, agents or
contractors.
4. LIMITATION OF LIABILITY:
a) You acknowledge that each of ASSE and Owner's obligations and liabilities with respect to the Product
are exhaustively defined in this Agreement. You are responsible for the consequences of any use of any of
the Product (whether or not such use was consistent with the license granted hereunder) created
therefrom. Whether or not ASSE or Owner has been advised of their possibility, neither ASSE nor Owner
nor any of its representatives or agents, directors, officers, employees, agents, representatives or
members, shall be liable, whether under contract, tort (including negligence) or otherwise, for any
indirect, special, punitive, incidental or consequential loss, damage, cost or expense of any kind
whatsoever and howsoever caused, that may be suffered by you or any of your directors, officers,
employees, agents, representatives or contractors or any third party.
b) If at any time an allegation of infringement of any rights of any third party is made, or in ASSE or
Owner's opinion is likely to be made, with respect to any of the Product, ASSE may, at its option and at
its own expense (i) obtain for you the right to continue using the Product, (ii) modify or replace the
Product or any portion thereof so as to avoid any such claim of infringements, or (iii) refund to you the
License Fee. ASSE shall have no liability to you if any claim of infringement would have been avoided
except for your refusal to use any modified or replacement Product supplied or offered to be supplied
pursuant to this Section 4(b) or to otherwise cease using the Product. Notwithstanding anything contained
in this Agreement, and except as set forth in Section 4(b) hereof, ASSE and/or Owner's liability to you for
damages pursuant to this Section 4(b), if any, shall not exceed the amounts of the License Fee paid by you
for the Product subject to any such claim.
c) Section 4(b) state the entire liability of ASSE and Owner with respect to the infringement or alleged
infringement of any third party rights of any kind whatsoever by any of the Product.
5. TERMINATION: This Agreement may be terminated immediately by Owner or ASSE upon breach
of any provision of this Agreement by you. Upon any termination of this Agreement, you shall
immediately discontinue the use of the Product and shall within ten (10) days either return files(s) on
diskette(s), if any, to ASSE or certify in writing to ASSE that the Product has been deleted from your
computer and is eliminated from your premises.
6. GOVERNING LAW: This Agreement shall be governed by the laws of the State of Illinois without
reference to its conflict of laws provisions and you further consent to jurisdiction by the state and federal
courts sitting in the State of Illinois.
7. MISCELLANEOUS: This Agreement constitutes the complete and exclusive agreement between
ASSE and you with respect to the subject matter hereof, and supercedes all prior oral or written
understandings, communications or agreements not specifically incorporated herein. This Agreement may
not be modified except in writing duly signed by an authorized representative of ASSE and you. If any
provision of this Agreement is held to be unenforceable for any reason, such provision shall be reformed
only to the extent necessary to make it enforceable, and such decision shall not affect the enforceability (i)
of such provision under other circumstances, or (ii) of the remaining provisions hereof under all
circumstances. Headings shall not be considered in interpreting the Agreement.
8. EXPORT: You may not load or export or re-export any of the Product or any underlying information
or technology except in full compliance with all United States and other applicable laws and regulations.
BY ACCESSING THE PRODUCT, YOU ACKNOWLEDGE THAT YOU HAVE READ THE
TERMS OF THIS LICENSE AGREEMENT AND AGREE TO BE BOUND BY ITS TERMS.
ASSE STANDARDS
Driving Improved Performance
ASSE’s voluntary national consensus standards help organizations
establish industry best practices, reference the latest state-of-the-art
practices and technology and provide their employees the safest and
most healthful work environment possible.
ANSI Secretariat for:

• A10 Construction & Demolition Operations
• A1264 Protection of Floor & Wall Openings
• Z9 Ventilation Systems
• Z10 Safety & Health Management
• Z15 Motor Vehicle Safety
• Z88 Respiratory Protection
• Z117 Confined Space
• Z244 Control of Hazardous Energy – Lockout/Tagout &
Alternative Methods
• Z359 Fall Protection
• Z390 Hydrogen Sulfide (H2S) Training Program
• Z490 Safety, Health & Environmental Training
• Z590 Competence & Certification in the Safety Profession and
Prevention Through Design
U.S. Technical Advisory Group Administrator for:
• Safety & Health Management Systems
• Risk Management/Assessment
For more information visit www.asse.org/standards

or contact customer service at +1.847.699.2929
Page Intentionally Left Blank
A S
S E
Printed in U.S.A.

520 North Northwest Highway, Park Ridge, IL 60068 USA
+1.847.699.2929
customerservice@asse.org • www.asse.org
Z244_1_2016

Ansi+asse Z244.1 2016

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ansi+asse Z244.1 2016

Uploaded by

Copyright:

Available Formats

ANSI/ASSE Z244.

American National Standard

ANSI/ASSE Z244.1 – 2016

4Casselogo-1200dpi_vector-1c-outline.pdf 1 1/20/2012 1:31:55 PM

American National Standard

The Control of Hazardous Energy

American Society of Safety Engineers

Approved October 13, 2016

American National Standards Institute, Inc.

Caution Notice: This American National Standard may be revised or

Published December 2016 by

American Society of Safety Engineers

Copyright ©2016 by American Society of Safety Engineers

No part of this publication may be reproduced

Printed in the United States of America

Organization Represented Name of Representative

Aluminum Association Mark Eliopulos

AMERICAN NATIONAL STANDARD Z244.1

1. Scope and Purpose

3.4 Alternative Method

disconnecting means and over-current protection can be energy-isolating devices. See

3.25 Risk Reduction Measure(s)

 Elimination of hazardous energy sources whenever practicable.

5.6 Information for Use

5.9 Restraint Devices

6.3 Hazardous Energy Control Program

Figure 1 – Flowchart for Controlling Hazardous Energy

6.4.3 Assessment of Training

NOTE 1: An example of a comprehensive specific machine, equipment or process

7.3.2 Protective Tags

NOTE 4: Another example of a marking or labeling system may involve a serialized

Figure 2 – The Risk Assessment Process

Table 1 – The Hazard Control Hierarchy

8.1.2.6 Use of Personal Protective Equipment (PPE)

8.2.5 Well-Tried Components

8.4.5 Provisions for Alternative Method Interruption

Figure 3 – Elements of Risk

A.1.4 Assess the Potential Severity of Harm

Annex B Remote Lockout System

Annex C Sample Lockout or Tagout Program and Policy

lockout or tagout system.

3. Release from Lockout or Tagout

4. High Voltage Work

tagout energy control procedure semiannually as a minimum to insure that employees

Annex D Sample of a Lockout or Tagout Application Inspection Form

LOCK/TAG/VERIFY PERIODIC INSPECTION

6. Do authorized employees know where to find the Lockout Procedure? Y N NA

9. Were the isolation devices properly identified on the Lockout Task Y N NA

22. Were any deficiencies identified? Y N NA

Annex E Sample Management of Change Form

Annex F General Lockout or Tagout Procedure

Annex G Sample of a Hazardous Energy Control Procedure

Annex H Samples of a Lockout or Tagout Placard

Annex I Lockout Tagout Permit

Line Manager: Division/Company: Cell Phone:

(Appointed) Authorized Employee: Division/Company: Cell Phone:

Service and/or Maintenance Purpose:

HAZARDOUS ENERGY CONTROL PROCEDURE (HECP) IDENTIFICATION:

Name: ______________________________ Signature: ______________________________

Appointed Authorized: ________________________ Signature: ________________________

Annex J Group Lockout Guidance

Annex K Group Lockout or Tagout

see Annex J Group Lockout Guidance, section V

Name: Signature:

Appointed Authorized: Signature: