How to Write a Machine-Specific Energy Control Procedure Under OSHA 1910.147

Published June 4, 2026 by LOTO Compliance

The written energy control procedure is the document an OSHA inspector reads against the actual machine. Not the program. Not the training roster. The procedure. It is where 1910.147 stops being a policy and starts being executable, and it is one of the most cited subparts of the standard year after year. The reason is simple. Plants write one procedure, photocopy it, and treat lockout as a single plant-wide habit. The standard does not work that way. A hydraulic press, a robotic weld cell, and a steam-jacketed kettle each have different energy sources, different isolation points, and different stored energy. Each needs its own procedure. This guide walks through what 1910.147(c)(4) actually requires, the six elements every procedure names, the narrow exception that lets you skip the document, and the specificity gaps that turn a written procedure into a citation anyway. It builds on our stored energy isolation piece and the employee classification guide, since the procedure names the authorized employees who run it.

What 1910.147(c)(4) Actually Requires

1910.147(c)(4)(i) requires that procedures be developed, documented, and used for the control of potentially hazardous energy when employees are engaged in servicing or maintenance. The key word is documented. The procedure has to exist on paper or in a system, not just in a maintenance technician's head.

1910.147(c)(4)(ii) then sets the content floor. The procedures have to clearly and specifically outline the scope, purpose, authorization, rules, and techniques to be used for the control of hazardous energy, and the means to enforce compliance. The standard breaks that into four named items: the intended use of the procedure, the steps for shutting down and isolating and blocking and securing the machine, the steps for the placement and removal and transfer of lockout and tagout devices and who has responsibility for them, and the requirements for testing to verify the effectiveness of the energy control measures.

That word "specifically" is the one that drives citations. A procedure that says "lock out all energy sources and verify zero energy" is documented but not specific. It names nothing. The authorized employee cannot execute it without already knowing the machine, which defeats the purpose. Specific means named disconnects, named valves, named bleed points, and an order of operations.

The Six Elements Every Procedure Should Name

The four required items expand into six practical sections once you account for the energy-source identification and magnitude that the verification step depends on. Build every procedure around these.

The energy-source section is where most plants undercount. A press is electrical, obviously. It is also pneumatic at the counterbalance, hydraulic at the overload, and gravitational at the ram. Four sources, four isolation requirements, four lines in the procedure. A procedure that locks the main disconnect and stops there leaves the ram free to drop and the counterbalance air charged. That is not a paperwork gap. That is a fatality mechanism, and it is the exact scenario that drives the enforcement cases.

The Verification Step Is Not Optional

1910.147(c)(4)(ii)(D) requires the procedure to include the requirements for testing the machine to verify the effectiveness of the energy controls. This is the step that separates a real isolation from a hopeful one. After the locks are on and the stored energy is released, the authorized employee attempts to operate the normal controls to confirm nothing energizes, then returns the controls to the neutral or off position.

The try-start is the cheapest verification, and it only proves the control circuit is dead. For machines with capacitive storage, a voltage test on the actual conductors is required because a capacitor can hold a lethal charge after the disconnect is open. For hydraulic and pneumatic systems, the gauge has to read zero after the bleed, not just after isolation. The procedure names which verification applies to which energy source. A generic "verify zero energy state" line does not tell the authorized employee how, and an inspector treats that as a missing verification step.

The Exception That Lets You Skip the Document

1910.147(c)(4)(i) contains a note with eight conditions. If a machine meets all eight, the employer does not need a documented procedure for it. The conditions are strict, and the word is all. Miss one and the written procedure is required.

1. The machine has no potential for stored or residual energy or reaccumulation of stored energy after shutdown.
2. The machine has a single energy source that can be readily identified and isolated.
3. The isolation and locking out of that energy source will completely de-energize and deactivate the machine.
4. The machine is isolated and locked out during servicing.
5. A single lockout device will achieve a locked-out condition.
6. The lockout device is under the exclusive control of the authorized employee performing the servicing.
7. The servicing does not create hazards for other employees.
8. The employer has had no accidents involving the unexpected activation or reenergization of that machine during servicing.

A bench grinder with a single cord-and-plug disconnect under the worker's exclusive control might qualify. A production press almost never does, because it has stored energy and multiple sources, which fails conditions one and two immediately. Do not lean on this exception for anything with a counterbalance, an accumulator, a capacitor, a raised mass, or a second energy feed. Most plants that claim the exception broadly are claiming it for machines that do not qualify, and that is a citation.

Where These Procedures Get Cited

Three failure patterns account for most of the 1910.147(c)(4) citations we see during gap analysis.

The generic plant-wide procedure

One document that says "all machines: lock the disconnect, verify zero energy." It is documented, so the plant assumes it is covered. It names no machine, no specific energy source, and no machine-specific verification. An inspector reads it against a multi-source press and writes it up. The fix is one procedure per machine or per identical machine group, built from the actual prints and a physical walk.

The procedure that does not match the machine

The plant wrote real procedures two years ago, then changed the equipment. A pneumatic clamp became hydraulic. A disconnect was relabeled during a panel upgrade. The procedure still describes the old configuration. An authorized employee following it isolates the wrong source. The annual periodic inspection is supposed to catch this, which is exactly why inspectors check the procedure against the machine and the inspection record together.

The missing stored-energy step

The procedure isolates the primary source and stops. No bleed step for the accumulator, no discharge for the capacitor, no block for the raised tooling. This is the most dangerous gap because the procedure looks complete to a reviewer who does not know the machine has stored energy. Our stored energy guide covers the hydraulic, pneumatic, and capacitive cases in detail.

A Workable Template Structure

Every procedure in a plant should follow the same layout so authorized employees can read any of them at a glance. A field-tested structure runs in this order.

1. Header: machine name, asset number, location, procedure number, revision date, and the authorized employees qualified to perform it.
2. Energy source table: each source, its type, its magnitude, and its isolation point identified by label and location.
3. Shutdown sequence: numbered steps to bring the machine to a safe stop before isolation.
4. Isolation and lockout: numbered steps to operate each disconnect or valve and apply each lock, in order.
5. Stored energy release: numbered steps to bleed, drain, block, or discharge, with the verification gauge or indicator named.
6. Verification: the specific test for each source confirming zero energy.
7. Restoration: the ordered steps to clear the area, remove locks, and return to service, including who removes each device.

Tie every procedure to the training records. The authorized employee classification only holds up if each procedure names its qualified employees and each of those employees has a documented machine-specific training certification. The procedure and the roster are read together during an audit, so they have to agree.

Frequently Asked Questions

Does OSHA require a separate written procedure for every machine?

Generally yes. 1910.147(c)(4)(i) requires documented energy control procedures, and the documentation has to be specific enough that an authorized employee can isolate every energy source on that machine. One generic procedure for a plant full of different equipment fails. There is a narrow exception in 1910.147(c)(4)(i) for single-source machines that meet eight specific conditions, but most production equipment has multiple energy sources and does not qualify.

What are the required elements of an energy control procedure?

1910.147(c)(4)(ii) names four. A statement of the intended use of the procedure. The specific steps for shutting down, isolating, blocking, and securing machines to control hazardous energy. The specific steps for placement, removal, and transfer of lockout devices and who is responsible for them. And the specific requirements for testing a machine to verify the effectiveness of the energy control measures. In practice you also name every energy source and its magnitude, which the verification step depends on.

What is the exception that lets you skip the written procedure?

1910.147(c)(4)(i) lets you skip the documented procedure only when all eight conditions are met, including that the machine has no potential for stored energy, has a single energy source readily identified and isolated, isolation completely de-energizes the machine, the machine is locked out during servicing, a single lockout device achieves a locked-out condition, the lockout is under the exclusive control of the authorized employee, the servicing creates no hazard for other employees, and the employer has had no accidents involving that machine. Miss one condition and the written procedure is required.

How specific does the isolation step have to be?

Specific enough to execute without guessing. Name the disconnect by its label and location, not just electrical. Name the valve number and the line, not just pneumatic. Identify the bleed or relief point for stored energy and the order of operations. An inspector reads the procedure against the actual machine. If the procedure says lock out the main disconnect and the machine has three disconnects, two unlabeled, the procedure fails on specificity even though it is technically written.

How often do machine-specific procedures need to be reviewed?

The annual periodic inspection under 1910.147(c)(6) reviews each procedure in use at least yearly, and that inspection is the practical review trigger. Beyond the calendar, any change to the machine, its energy sources, or its controls requires updating the procedure before the next servicing task. A procedure that still references a pneumatic press the plant converted to servo two years ago is both wrong and a citation.

Who is allowed to write the energy control procedure?

OSHA does not name a required author, but the procedure has to be accurate, which means whoever writes it needs to know the machine's energy sources, controls, and stored-energy points. In practice that is a maintenance lead, a controls engineer, or a safety professional working from the electrical and pneumatic prints and a physical walk of the equipment. A procedure written from a template without walking the machine is where the specificity gaps come from.