LOTO Procedures and the Annual Periodic Inspection

An energy control procedure is a written document that tells anyone qualified to read it how to isolate one specific machine. OSHA does not accept a single plant-wide sheet that says “lock out the disconnect”. The standard at 29 CFR 1910.147 builds an energy control program from three parts: documented procedures, trained employees, and periodic inspections of those procedures. This lesson is about the first and third parts, which is where lead techs and supervisors live.

Why it matters on the job

The individual lock is the part a technician owns. The program is the part that decides whether the lock was applied to the right device in the right order, and whether anyone would notice if it were not.

When an inspector arrives after an incident, they ask for the procedure covering that machine, the training records for the person who applied the lock, and the last written certification of inspection. A plant that can produce all three has a program. A plant that produces a binder of near-identical sheets has paperwork.

What makes a procedure machine specific

The standard requires documented procedures for the control of hazardous energy, and the word doing the work is specific. A usable procedure lets a technician who has never touched that machine identify and control every energy source on it without guessing.

That means the document has to name the machine it applies to, name and locate every energy isolating device on it (each disconnect, valve, breaker and blocking point, by tag number and physical location), and set out the steps for shutting down, isolating, applying devices, relieving stored energy, and verifying isolation in the order the standard requires. It also has to say who is responsible for each of those actions, and what has to be done to restore the machine to service afterward.

The test of a procedure is not only whether it is accurate. It is whether it is complete: the second feed nobody documented is the one that stays live.

The exception, and its price

The standard allows a machine to go without a documented procedure only under a narrow set of conditions, all of which must hold together. In practice they describe a small, simple, single-source machine with no stored energy, isolated by one readily identifiable device under the exclusive control of the person doing the work, where the servicing creates no hazard to anyone else.

Read that as a list of conditions rather than a description of a machine, because every one of them has to be true. Most equipment in a working plant fails at least one, and the cost of getting it wrong is that the machine had no procedure and no defense.

The annual periodic inspection

At least annually, the employer has to inspect the energy control procedure. Three details carry the weight.

It inspects the procedure, not the machine. This is not a PM, not a housekeeping walk, and not a check that the locks are hanging in the right place. The question being answered is whether the written procedure is still adequate and whether employees are following it as written.

The inspector has to be independent. The standard requires the inspection be performed by an authorized employee other than the one or ones utilizing the energy control procedure being inspected. A tech cannot inspect a procedure they work under. This is the requirement that gets skipped, because the person who knows the machine best is usually the person who uses the procedure.

It has to be certified in writing. The certification records that the inspection was performed: which procedure, on what date, which employees were included, and who performed the inspection.

The annual inspection turns on one word: the inspector is an authorized employee other than the one using the procedure

Worked example: scheduling a year of inspections

A plant has 46 machine-specific energy control procedures and 6 authorized employees, working in three pairs (A and B, C and D, E and F). Each pair is the regular crew for roughly a third of the equipment.

Spread the inspections rather than saving them for December: 46 procedures over 12 months is 3.83 procedures per month, so schedule 4 per month. Four per month gives 48 inspection slots in the year against 46 procedures, which leaves two slots of slack for the ones that get rescheduled around production.

Now apply the independence rule. The 15 or so procedures that A and B work under are inspected by C, D, E or F, never by A or B. Do the same for the other two pairs, and every procedure has four eligible inspectors instead of six. Build that constraint into the schedule at the start of the year, because discovering it in month 11 means the December inspections get done by whoever is available, which is exactly the failure the rule was written to prevent.

Each of the 46 inspections produces one written certification. At year end, 46 certifications, not one summary memo.

Where it bites

• A template is not a procedure. Copying one sheet across 40 machines and changing the asset number produces a document that is wrong for 39 of them. Every isolating device gets found and written down on the machine it belongs to.
• Procedures go stale when the machine changes. A new feed, a rebuilt panel, an added accumulator: any of these makes the written procedure incomplete on the day the work is finished. Updating the procedure belongs in the change work order, not in next year’s inspection.
• The inspection is not a formality to survive. Its purpose is to find deviations, and finding one is a successful inspection. A year of inspections that all report perfect compliance is a signal about the inspections, not about the plant.
• Deviations feed back into training. Where an inspection shows employees are not following the procedure as written, the fix is retraining and a corrected procedure, not a note in a file.
• Annually means at least annually. It is a floor. Machines that change often, or that several crews work under, earn a shorter cycle by judgment rather than by rule.