Tagout-Only Systems Under OSHA 1910.147: When a Tag Without a Lock Is Legally Permitted
Tagout looks like the easy path. A tag is cheaper than a lock, faster to hang, and it goes on anything. That is exactly why it gets misused, and why tagout-only systems are one of the quietest sources of OSHA findings we see on plant floors. The standard does not treat a tag and a lock as interchangeable tools you pick by preference. It builds a clear hierarchy, puts lockout on top, and allows tagout only when specific conditions are met. Most facilities that lean on tags are not meeting those conditions, and they do not find out until an inspector or an incident makes the point for them.
This guide lays out when tagout-only is actually permitted under 29 CFR 1910.147, what the capable-of-being-locked-out test really means, the full employee protection demonstration the standard puts on the employer, the additional safety measures a compliant tagout system requires, and the audit traps that catch facilities using a tag where a lock belongs.
Lockout First: The Rule the Standard Is Built On
The hierarchy is written into the standard in plain language. 1910.147(c)(2)(iii) says that if an energy isolating device is capable of being locked out, the energy control procedure shall use lockout, unless the employer can demonstrate that the use of a tagout system will provide full employee protection. That sentence does the heavy lifting. Lockout is mandatory on any device that can accept a lock. Tagout is allowed only on devices that cannot, or where the employer clears a high evidentiary bar to prove a tag does as much as a lock.
The reason sits in the difference between the two devices. A lockout device is a physical restraint. It holds an energy isolating device in the safe position and physically prevents anyone from operating it without first removing the lock with a key the authorized employee controls. A tagout device is a warning. It tells people not to operate the device, and that is the entire extent of its power. Nothing about a tag stops a hand from turning the switch. It depends completely on every person on the floor reading it, believing it, and respecting it, every single time.
That dependence on human behavior rather than physical control is why OSHA ranks tagout below lockout, and why a facility cannot default to tags because they are convenient. The convenience is the hazard. A program that hangs tags on lockable disconnects has swapped a physical guarantee for a hope that nobody makes a mistake.
The Capable-of-Being-Locked-Out Test
Everything turns on whether the device is capable of being locked out, so the standard defines the phrase carefully. Under 1910.147(b), an energy isolating device is capable of being locked out if it meets any one of these conditions:
- It has a hasp or other means of attachment to which, or through which, a lock can be affixed.
- It has a locking mechanism built into it.
- It can be locked out without dismantling, rebuilding, or replacing the device, and without permanently altering its energy control capability.
That last condition is the one facilities trip over. A valve, a disconnect, or a breaker that does not currently have a lock point is still considered lockable if a simple, low-cost adapter or attachment lets you lock it without permanently changing it. Lockout hardware for valves, breakers, plugs, and cylinders is inexpensive and widely available. The existence of that hardware means very few modern energy isolating devices are genuinely incapable of being locked out. The honest answer for most plants is that nearly everything on the floor is lockable, so nearly everything has to be locked.
The standard pushed this even further for newer equipment. Machines or equipment installed, modified, or overhauled after January 2, 1990 must be designed to accept a lockout device. Over three decades of equipment turnover, that requirement has shrunk the genuine tagout-only population to a small set of legacy devices. If your tagout list is long, the list itself is a red flag.
Full Employee Protection: The Demonstration Burden
There is a second, separate path to using tagout, and it is the one facilities misunderstand most. Even on a lockable device, an employer may use tagout if it can demonstrate that the tagout program provides full employee protection. This is not a loophole that lets you tag instead of lock. It is a demanding standard, and the burden of proof sits with the employer, not the inspector.
1910.147(c)(3) spells out what full employee protection requires. When tagout is used on a device that is capable of being locked out, the tagout device has to be attached at the same location the lock would have gone, and the employer has to provide additional means to deliver a level of safety equivalent to lockout. The tag by itself never clears the bar. It is the tag plus something else that makes the arrangement defensible.
1910.147(c)(3)(ii) lists the kinds of additional measures that count:
| Additional safety measure | How it raises protection |
|---|---|
| Remove an isolating circuit element | Physically breaks the circuit so the control path cannot be completed even if the tagged switch is operated |
| Block a control switch | Prevents the tagged switch from physically moving to the energized position |
| Open an extra disconnecting device | Adds a second isolation point in series, so re-energizing requires defeating two devices, not one |
| Remove a valve handle | Takes away the means of operating a fluid or gas valve, so the tagged valve cannot be casually turned |
Each of these works because it reintroduces a physical barrier alongside the warning. That is the whole point. The standard is not asking for a better tag. It is asking the employer to engineer back the physical control that a lock would have provided. When a facility claims full employee protection but the only thing on the device is a tag, the demonstration fails on its face.
Tag Limitations Your Training Has to Cover
Because a tag carries no physical force, 1910.147 puts specific training requirements around its limits. Under 1910.147(c)(7)(ii), every employee in a facility that uses tagout has to be trained on the limitations of tags. The training has to make these points explicit, and an auditor will check that it did:
- Tags are warning devices only. They do not provide the physical restraint a lock provides.
- A tag must never be removed without authorization from the person who applied it, and it must never be bypassed, ignored, or otherwise defeated.
- Tags must be legible and understandable by all authorized, affected, and other employees who work in the area.
- Tags and their attachment means must withstand the environment, including wet, corrosive, or high-heat conditions where a flimsy tag would degrade.
- Tags can give a false sense of security. Their meaning has to be understood as part of the whole energy control program, not as a substitute for it.
- Tags must be securely attached so they do not come off accidentally, using a non-reusable, self-locking attachment with a minimum unlocking strength.
This training overlaps with the broader authorized and affected employee structure. If you are not clear on who needs which level of training, our breakdown of authorized versus affected versus other employees covers how those roles map to the tag-limitation requirement.
Where Tagout-Only Legitimately Shows Up
Tagout-only is not always wrong. There are real devices on real floors that cannot accept a lock without being rebuilt, and for those the standard allows a tagout system built to the full employee protection standard. The honest cases tend to be older, specialized equipment:
- A legacy disconnect or selector with no hasp, no built-in lock, and no manufacturer or aftermarket adapter that fits without permanent modification.
- Certain older valve types where no commercially available lockout hardware fits the stem or handle configuration.
- A handful of process controls on equipment that predates the 1990 design requirement and has not been overhauled since.
Even in these cases, the device should be on a short, documented list with a written justification for why it cannot be locked, the additional safety measure that brings it to equivalent protection, and a plan to convert it to lockout at the next overhaul or replacement. A tagged device is a temporary state to be engineered out, not a permanent fixture. This thinking belongs inside each machine-specific energy control procedure, where the isolation method for every energy source is documented down to the device.
The Audit Traps
When we run a gap analysis, tagout is one of the first things we pressure-test, because the failures are predictable. Four show up again and again.
Tagging lockable devices. The most common finding by far. A facility tags a disconnect that has a perfectly good hasp, or one that takes a five-dollar breaker lockout. The device is capable of being locked out, so the tag is a violation regardless of how disciplined the crew is. This is the failure that turns into a 1910.147(c)(2)(iii) citation.
No full employee protection demonstration. A facility uses tags on lockable equipment and, when asked, has no written demonstration of equivalent protection and no additional safety measure on the device. The burden was theirs and they never met it.
Tag-only on a disconnect that should be locked. Electrical disconnects are lockable almost without exception, yet they are a frequent spot for a stray tag-only practice. We cover the lockout side of this in detail in our guide to electrical disconnect lockout, and the short version is that a tag on a lockable disconnect is hard to defend.
Missing tag-limitation training. The program allows tagout but the training records never show that employees were taught the limitations of tags. Under 1910.147(c)(7)(ii) that is its own deficiency, separate from the device-level findings.
The pattern underneath all four is the same. Tagout gets treated as a casual substitute for lockout instead of the tightly conditioned exception the standard makes it. An LOTO program audit walks the floor device by device, confirms which energy isolating devices are genuinely incapable of being locked out, and rewrites the rest as lockout. The result is almost always a much shorter tagout list and a defensible program. ECPL logs each device, its isolation method, and its conversion status in LockStep, so the tagout exceptions stay visible and keep shrinking rather than quietly multiplying in a binder.
Free LOTO Assessment
ECPL audits your energy control program against 1910.147, including every tagout-only device, the capable-of-being-locked-out test, and the full employee protection demonstration. Chicago, Detroit, Indianapolis, national travel.
Request Your AssessmentFrequently Asked Questions
When does OSHA 1910.147 allow tagout instead of lockout?
Tagout alone is permitted when the energy isolating device is not capable of being locked out. If the device can be locked out, 1910.147(c)(2)(iii) requires lockout unless the employer demonstrates that a tagout program provides full employee protection equal to lockout. New or overhauled equipment must be designed to accept a lock, which has steadily shrunk the situations where tagout-only is even an option.
What does capable of being locked out mean under 1910.147?
Under 1910.147(b), an energy isolating device is capable of being locked out if it has a hasp or other attachment point a lock can pass through, has a built-in locking mechanism, or can be locked without dismantling, rebuilding, or permanently altering it. If a low-cost adapter or a simple existing feature lets you attach a lock, the device counts as lockable and tagout-only is off the table.
What is full employee protection in a tagout program?
Full employee protection means a tagout system on a lockable device must deliver protection equal to lockout. Under 1910.147(c)(3), that requires the tag plus at least one additional safety measure that reduces the chance of inadvertent energization, such as removing an isolating circuit element, blocking a control switch, opening an extra disconnect, or removing a valve handle. The employer carries the burden of demonstrating equivalence.
Why is a tag weaker than a lock under OSHA?
A lock is a physical restraint that physically prevents the device from being operated. A tag is only a warning. It tells people not to operate the device, but nothing stops someone from removing it or ignoring it. Because a tag relies entirely on awareness and discipline rather than physical control, 1910.147 treats lockout as the default and tagout as the exception that has to be justified.
What additional safety measures does a tagout system need?
1910.147(c)(3)(ii) gives examples: removing an isolating circuit element, blocking a control switch, opening an extra disconnecting device, removing a valve handle to reduce the chance of inadvertent energization, or taking a similar step that adds a layer of protection. The measure has to make the tagout arrangement genuinely as safe as a lock, not just add a second tag.
How does tagout show up in a LOTO program audit?
An auditor looks for tagout used on devices that are actually lockable, which is the most common finding. The reviewer checks whether each tagout-only device is truly incapable of being locked out, whether the full employee protection demonstration exists in writing, whether the additional safety measure is specified per machine, and whether tag-limitation training is documented. Tagout shortcuts on lockable equipment draw citations fast.