The short answer: 29 CFR 1910.147, OSHA's control of hazardous energy standard, requires that before a maintenance worker services equipment where unexpected startup or the release of stored energy could injure them, the energy is isolated at an energy-isolating device, that device is locked in the safe position, any residual energy is relieved, and de-energization is verified before work begins. The standard sets a six-step sequence in 1910.147(d), allows a narrow minor-servicing exception under 1910.147(a)(2)(ii), and requires equivalent protection through group lockout under 1910.147(f)(3) when a crew works together. For facilities teams, the durable practice is a documented, machine-specific procedure for every energy source in the building, applied the same way whether the job is a five-minute belt change or a two-day rebuild.
Does OSHA require lockout/tagout for facilities maintenance work?
Yes. 29 CFR 1910.147 applies whenever servicing or maintenance exposes an employee to the unexpected energization, startup, or release of stored energy from equipment. That covers most of what a facilities team does: clearing a jammed conveyor, replacing a pump seal, working inside an air handler, or repairing a rooftop unit, wherever the machine could start or discharge energy while someone is in the danger zone. The standard reaches electrical energy but is not limited to it, so a facilities program has to account for pneumatic pressure, hydraulic pressure, steam, water under head pressure, gravity, and stored mechanical energy in springs and counterweights as well.
The reason the standard matters more in facilities than on a fixed production line is variety. A line operator locks out the same machine every day. A maintenance technician meets a new machine and a new energy profile on nearly every work order, which is exactly the condition under which a generic, one-size procedure fails. That is why 1910.147 is built around machine-specific procedures and verification rather than a single site-wide rule, and why the strongest facilities programs keep a written procedure tied to each significant piece of equipment rather than relying on the technician to improvise the isolation each time.
What are the six steps of the lockout sequence?
The standard sets an ordered application sequence in 1910.147(d), and the order is not optional: each step depends on the one before it. Skipping straight to hanging a lock, without knowing the energy sources or relieving stored energy, is where the sequence breaks and people get hurt. Work the steps in order on every job.
- Prepare for shutdown (1910.147(d)(1)). Before anything is switched off, the authorized employee identifies the type and magnitude of the energy, the hazards it presents, and the means to control it. On an unfamiliar machine this is the step that decides whether the isolation will actually be complete.
- Shut down the machine (1910.147(d)(2)). Turn the equipment off using its established procedure, in an orderly way that does not create an additional hazard as it winds down.
- Isolate the energy (1910.147(d)(3)). Operate every energy-isolating device needed to cut the machine off from its source. An energy-isolating device is a mechanical device such as a circuit breaker or a disconnect switch; a control such as a start/stop button or a selector switch is not one, because it does not physically break the energy path, a distinction 1910.147(b) draws explicitly.
- Apply the lockout or tagout devices (1910.147(d)(4)). Affix a lock that holds each isolating device in the safe or off position. A tag alone is a warning, not a physical restraint, so lockout is the default and tagout is used only where a device cannot accept a lock and the employer can show equivalent protection.
- Relieve stored energy (1910.147(d)(5)). Discharge, block, bleed down, or restrain any residual or stored energy: trapped hydraulic or pneumatic pressure, a raised platform or ram, a charged capacitor, a compressed spring. This is the step facilities work skips most often, and it is the one that injures people after the power is already off.
- Verify isolation (1910.147(d)(6)). Before starting work, confirm the machine is actually de-energized: try the normal start controls (then return them to off), test for voltage, or check gauges, so the zero-energy state is proven rather than assumed.
A California FACE investigation shows what the missing steps cost. In report 01CA009, a 37-year-old elevator mechanic helper was crushed inside an escalator he was servicing when the power came on unexpectedly. He had removed the escalator steps and was standing in the mechanism; there were no locks or tags on the controls, and the disconnect at the circuit panel had not been locked and tagged out. The power started the unit when a co-worker dropped an electrical box and triggered a relay. A mechanical blocking device was available but not used. The CA/FACE investigator recommended that employers ensure workers follow lockout/tagout procedures and block mechanisms before maintenance. The transferable point is that isolation and verification, steps three, four and six, are what stand between a maintenance worker and an unexpected start, which is precisely what 1910.147(d) is written to guarantee.
When does the minor-servicing exception apply?
Only narrowly, and rarely to a facilities repair. 1910.147(a)(2)(ii) exempts minor tool changes, adjustments, and other minor servicing activities from full lockout only when they take place during normal production operations, are routine, repetitive, and integral to the use of the equipment, and are performed using alternative measures that provide effective protection. All of those conditions have to be met at once. A scheduled repair, a breakdown call, or work that requires removing a guard or reaching into a danger zone is servicing under the standard, not minor servicing, and it needs the full sequence.
The exception exists for the line operator clearing a routine jam mid-shift, not for the maintenance technician who arrives to fix the machine. Facilities teams get into trouble when they borrow the operator's shortcut for a maintenance task: the work is no longer routine and repetitive, the alternative protection usually is not in place, and the exception's conditions are not satisfied. When in doubt, treat the task as full lockout, because that is the answer 1910.147(a)(2)(ii) gives for anything outside its narrow set of conditions.
How does group lockout work when several trades share a job?
Group lockout gives every worker on a shared job their own personal lock, so no one's protection depends on someone else. 1910.147(f)(3) requires that when servicing is performed by a crew, craft, or department, the group uses a procedure that gives each employee protection equivalent to applying their own personal lockout device. In practice that means a group lockout device or box: each energy source is locked, the keys go into a lockbox, and every authorized employee hangs a personal lock on that box when they start work and removes it only when they personally leave.
The standard adds accountability on top of that. 1910.147(f)(3)(ii) vests primary responsibility in an authorized employee who ascertains the exposure status of each group member, and where more than one crew is involved, requires a coordinator to maintain continuity of protection across shift or crew changes. This matters in facilities work because the electrician, the millwright, and the controls technician often converge on the same rooftop unit or the same pump skid. A single lock hung by the first trade to arrive protects that person and no one else. Group lockout is what keeps the last worker inside the machine protected when the first has already gone home, and consensus practice in ANSI/ASSP Z244.1, the industry standard for the control of hazardous energy, is built around the same principle.
How often must the energy-control program be inspected?
At least annually, and the inspection has to be documented. 1910.147(c)(6)(i) requires the employer to conduct a periodic inspection of each energy-control procedure at least once a year, performed by an authorized employee other than the ones using the procedure being inspected, to catch and correct any deviations or inadequacies. This is not a paperwork audit of the binder; it is a check that the written procedure still matches the machine and that the people applying it are doing so correctly.
The record has to name specifics. 1910.147(c)(6)(ii) requires the employer to certify the inspection, identifying the machine or equipment, the date, the employees included, and the person who performed it. For a facilities team, the annual inspection is also the moment to catch procedures that have drifted out of date: a new disconnect added during a retrofit, a pump replaced with a different model, a control panel rewired. A procedure that no longer describes the current energy sources is worse than none, because it tells the technician the isolation is complete when it is not. Keeping the procedures current, verifying zero energy on every job, and giving every worker on a shared job their own lock are what turn 1910.147 from a binder on a shelf into protection on the floor.
