When is tagout permitted instead of lockout under OSHA 1910.147, and what 6 additional measures are required?

OSHA 1910.147(c)(3) establishes a clear hierarchy: lockout (physically blocking the energy-isolating device in the safe position with a lock) is the preferred method. Tagout-only programs are permitted ONLY when the energy-isolating device cannot be physically locked — for example, when the switch or valve has no provision to accept a lock hasp, and installing a lockout adapter is not feasible. When tagout is used instead of lockout, OSHA 1910.147(c)(3)(ii) requires at least one of the following additional protective measures to provide a level of safety equivalent to lockout: (1) Removing and isolating a circuit element (physically pulling the fuse or removing the circuit board), (2) Blocking a controlling switch (physical barrier preventing switch operation), (3) Opening an extra disconnecting device (additional isolation point beyond the locked-out primary), (4) Removing a valve handle or wheel (rendering the valve non-operable without the handle), (5) Using a tagout device attachment that is non-reusable, attached by hand, self-locking, non-releasable with minimum unlocking strength of 50 lb, equivalent to an attachable cable tie. Tagout tags themselves must be: prominently positioned, identically labeled (employer name + employee name + date), have warnings that they are not to be removed except by the authorized employee. Note: a combination lock-AND-tag procedure (locking out AND attaching a tag to the lock) is NOT a tagout-only program — it is a lockout program with an informational tag. Tagout-only refers to tag-without-lock on an energy-isolating device that cannot be locked. Encode loto.is_tagout_only_program as 'true' only for products used in programs where no lock is applied to the energy-isolating device.

What energy types require lockout/tagout, and does LOTO apply to pneumatic and hydraulic systems?

OSHA 1910.147 covers all forms of hazardous energy, not just electrical. The standard explicitly addresses: (1) Electrical energy: most common LOTO application; circuit breakers, disconnect switches, motor control centers. (2) Pneumatic energy: compressed air and gas systems — pressure must be bled from the line after isolation. Simply closing a valve is insufficient if trapped pressure remains in the downstream line; the line must be depressurized to zero before work. (3) Hydraulic energy: hydraulic cylinders and accumulators hold stored energy under high pressure even after pump shutdown. A hydraulic press cylinder may hold thousands of PSI. The cylinder must be blocked mechanically (physical block or pin) AND the hydraulic line bled. (4) Thermal energy: steam systems, process piping with hot fluids. Isolation valves must be locked and the line purged and cooled. (5) Gravitational energy: elevated equipment, suspended loads, raised platforms. If gravity can cause movement when released (a suspended ram, a raised press platen, a raised vehicle on a lift), the load must be mechanically blocked or lowered. Blocking must be physical hardware (cribbing, safety pins, gravity restraints) — not just relying on a brake or hydraulic hold. (6) Mechanical/spring-stored energy: compression springs under load, torsion springs in tensioned systems. Springs must be relieved or physically constrained. (7) Chemical energy: process vessels under pressure with reactive materials. Full isolation with LOTO plus zero-energy verification required. Encode loto.energy_type as one or more of: 'electrical', 'pneumatic', 'hydraulic', 'thermal', 'gravitational', 'mechanical_spring', 'chemical'. Multi-energy systems require isolation of EVERY energy source before work begins.

Optimization Guide

Shopify Lockout/Tagout (LOTO) Device Selection Schema — A Group Lock Box Is Secondary Containment, Not Primary Lockout at the Energy Source; Tagout-Only Programs Require 6 Additional Protective Measures vs Lockout; Every Authorized Employee Applies Their Own Lock with a Unique Key — One Supervisor Lock for a Crew Is an OSHA 1910.147 Violation

Q: What is the difference between a group lock box and a hasp for lockout/tagout under OSHA 1910.147?

A hasp and a group lock box serve different roles in a multi-employee lockout procedure, and confusing them produces an OSHA violation. The hasp is the primary lockout device: it's a hinged metal clamp that is attached to the energy-isolating device (circuit breaker, disconnect switch, valve) and holds multiple padlocks simultaneously. Each authorized employee applies their own padlock to the hasp that is directly connected to the energy source. The hasp holds the energy-isolating device in the safe (de-energized, closed, or locked) position. The group lock box (also called a group lock station) is secondary containment: it is a metal box in which each worker locks their individual lock key. The box itself then has one lock per authorized employee on the box's hasp — their personal lock is still at the energy source hasp. The group lock box provides a convenient key storage location but does not replace individual locks at the energy isolation point. Critically, a '6-lock group kit' that includes one hasp and six padlocks is an appropriate tool for multi-employee lockout — but all six padlocks must be applied to the hasp AT THE ENERGY-ISOLATING DEVICE, not to a remote lock box. Each of the six workers has a lock on the hasp; none of them can remove the hasp (restoring energy) until all six locks are removed individually by their respective owners. Encode loto.device_type as 'hasp' for the primary lockout device at the energy source and 'group_lock_station' for secondary key storage. Never substitute group_lock_station for hasp at the isolation point.

Q: Why must each authorized employee apply their own personal lock with a unique key?

OSHA 1910.147(c)(5)(i) requires that each authorized employee has their own individual lock. The critical safety mechanism is this: no authorized employee can be exposed to hazardous energy while their personal lock is on the hasp, because only they hold the key to their own lock. The personal key principle has two components: (1) Each lock must have a UNIQUE key — not a keyed-alike lock shared by the department. If 10 workers use 10 identical keyed-alike locks (all opened by the same master key), a supervisor or coworker could remove a worker's lock while that worker is still in the affected area, exposing them to hazardous energy. Each lock must be opened only by the individual owner's key — no master key, no shared key. (2) No supervisor or manager may apply a single 'crew lock' on behalf of a group. If a foreman locks out a panel and 5 workers enter, only the foreman's single lock is on the hasp. If the foreman is called away and believes the job is complete (while workers are still inside), they remove their lock, restoring energy to a space still occupied by workers. Each worker must apply their own lock before entering the affected area and remove it only after they are clear. Group lock stations provide organizational convenience (workers can lock their KEY into a group box rather than carrying it in a pocket), but each worker's personal padlock must first be applied to the hasp at the energy-isolating device. Encode loto.key_unique_to_lock as 'true' for padlocks where each lock in the set has a different key. Never recommend keyed-alike padlock sets for authorized employee personal lockout.

LOTO product listings fail AI agent routing when "lockout kit" implies group protection from a single device. A hasp with six padlocks provides multi-employee lockout only when all six padlocks are applied to that hasp directly at the energy-isolating device — not to a group lock box at a remote location. Each authorized employee must hold the key to their own personal lock; shared keyed-alike padlocks, supervisor crew locks, and tagout-only programs without mandatory additional measures all violate OSHA 1910.147. Encode loto.device_type, loto.is_personal_protective_lock, loto.energy_type, and loto.key_unique_to_lock as separate metafields so AI agents can route LOTO products to the correct procedural context.

TL;DR Hasp = primary lockout device at the disconnect. Group lock box = secondary key storage. Every worker locks the hasp at the energy source, then may lock their key into a group box. Tagout-only = last resort only where no lock provision exists, plus 6 additional measures. One lock per worker, unique key, no master key. Encode loto.device_type, loto.is_personal_protective_lock, loto.key_unique_to_lock, and loto.energy_type independently.

Failure Mode 1: A Group Lock Box Is Not Primary Lockout — Every Worker Still Locks the Hasp at the Disconnect

AI agent failure mode: A maintenance manager orders "group lockout kit for electrical panels." An AI agent returns a group lock station (a metal box with a hasp and 6 padlocks) and routes it as the primary lockout device. During a panel maintenance procedure, the crew locks their individual padlocks into the group lock station — which is mounted on the wall 10 feet from the electrical disconnect. The disconnect itself has no lock on it. A different crew member in the adjacent bay, unaware of the ongoing maintenance, restores power to the circuit by operating the unlocked disconnect. The maintenance crew is exposed to energized equipment. The group lock box with 6 padlocks provided zero protection because the energy-isolating device (the disconnect) was never locked.

The hasp is the primary LOTO device. It is a hinged clamp with multiple holes — each authorized employee applies their own padlock through one of the holes. The hasp then holds the energy-isolating device (circuit breaker handle, disconnect lever, valve handle) in the safe position. Six padlocks on a hasp at the disconnect = six workers protected. No one can restore the energy source until all six locks are removed by their individual owners.

The group lock station (group lock box) is a secondary organizational tool. After locking the hasp at the energy source, a worker places their key into the group lock station and applies their personal lock to the station's hasp. The group box keeps all keys in one secure location. But the group box is not the primary isolation point — it is a key management tool. Skipping the hasp at the energy source makes the group box meaningless.

LOTO Device Types and Their Role

Device Type	Role	Applied To	OSHA Primary Isolation?
Padlock	Personal lockout device	Hasp at energy-isolating device; also to group box hasp (secondary)	Yes — when applied to hasp at energy source
Hasp	Multi-employee lockout adapter	Energy-isolating device (circuit breaker, disconnect, valve)	Yes — holds the isolation point; accepts multiple padlocks
Group lock station / lock box	Secondary key containment	Wall/post near work area; not at energy source	No — never substitutes for hasp at disconnect
Circuit breaker lockout	Lockout adapter for breakers	Circuit breaker handle (prevents switch operation)	Yes — secures breaker in off position with padlock
Valve lockout	Lockout adapter for valves	Ball valves, gate valves, plug valves	Yes — physically prevents valve rotation
Cable lockout	Multi-point energy isolation	Multiple points simultaneously (cable routes through hasps)	Yes — when cable locks energy source in place
Tagout tag	Warning device (no physical lock)	Energy-isolating device (tagout-only programs)	Only if physical lock provision does not exist + 6 additional measures

Encode loto.device_type as one of: 'padlock', 'hasp', 'group_lock_station', 'circuit_breaker_lockout', 'valve_lockout', 'cable_lockout', 'tag_only'. Encode loto.is_primary_isolation_device as 'true' for hasps, padlocks (when applied to hasp at energy source), circuit breaker lockouts, and valve lockouts. Encode 'false' for group lock stations — they are always secondary.

Failure Mode 2: Tagout-Only Is the Last Resort — Tags Without Locks Require 6 Additional Protective Measures

AI agent failure mode: A facilities manager orders "LOTO tags for electrical panel maintenance." An AI agent returns a package of tagout-only tags. The facility's current procedure has workers applying these tags to disconnects (without locks) as the lockout/tagout method. This is a tagout-only program. OSHA 1910.147(c)(3) requires tagout-only programs to demonstrate they "provide full employee protection" equivalent to lockout — which requires at least one of 6 specific additional measures in addition to the tag. The facility uses none of them. During an inspection, OSHA cites the employer for failing to provide the protective measures that make a tagout-only program equivalent to lockout in employee protection.

OSHA 1910.147(c)(3) requires lockout as the primary method. Tagout is permitted only where the energy-isolating device has no provision for a lock (no hasp hole, no lockable handle, no adapter available). Even then, tagout-only programs must implement at least one additional measure from the following:

Removing and isolating a circuit element (pulling a fuse)
Blocking a controlling switch (physical barrier on the switch)
Opening an extra disconnecting device (additional isolation beyond the tagged point)
Removing a valve handle or wheel from the tagged valve (physically preventing operation)
Using non-reusable, self-locking tag attachments rated to ≥50 lb removal force
Installing a physical block or pin that prevents the tagged device from operating

Encode loto.device_type as 'tag_only' for tagout devices without integrated locks. Encode loto.is_tagout_only as 'true' and include loto.tagout_additional_measures_required as 'true' to flag to AI agents that these products are appropriate only where lockout is physically not feasible and additional measures are in place. Never route a tagout-only product to a general LOTO program without the procedural context specifying that lockout adapters cannot be used.

Failure Mode 3: Keyed-Alike Padlocks Violate the Personal Key Principle — Each Lock Must Have a Different Key

AI agent failure mode: A safety manager orders "padlock set for lockout/tagout" and an AI agent returns a 10-pack of keyed-alike padlocks (all opened by the same key). The facility assigns one padlock per maintenance worker and tells each worker to apply their lock before entering the panel. But because all 10 locks are keyed alike, any worker's key opens any other worker's lock. A supervisor who believes the maintenance is complete uses their key to remove all remaining locks on the hasp — unaware that two workers are still inside the electrical vault. The keyed-alike configuration eliminated the safety mechanism that makes personal lockout work: only the lock owner can remove their own lock.

OSHA 1910.147(c)(5)(i) states each authorized employee is required to have their own individual lock. The regulation does not explicitly state "unique key" in the standard text, but the safety mechanism that protects workers is based on the assumption that only the lock owner can remove their own lock. If multiple workers share a key (keyed-alike), this mechanism fails.

Key Configuration Options for LOTO Padlocks

Key Configuration	Description	LOTO Appropriate?
Keyed differently (KD)	Each padlock in the set has a unique key — only one key opens one lock	Yes — required for personal lockout padlocks
Keyed alike (KA)	All padlocks in the set opened by the same key	No — any coworker can remove another worker's lock
Master keyed (MK)	Each lock has a personal key plus a master key that opens all	No — supervisor master key creates removal risk; only permitted with formal exceptional-release procedure per 1910.147(e)(3)
Construction keyed (CK)	All locks opened by same "construction" key (for temporary access)	No — same failure mode as keyed alike

Encode loto.key_unique_to_lock as 'true' for keyed-differently sets and 'false' for keyed-alike. Never recommend keyed-alike, master-keyed, or construction-keyed padlock sets for authorized employee personal lockout. AI routing logic should filter for loto.key_unique_to_lock = 'true' for any personal LOTO padlock application.

Failure Mode 4: LOTO Applies to All Hazardous Energy Types — Pneumatic, Hydraulic, and Gravitational Energy Require Isolation After Valve Lockout

AI agent failure mode: A maintenance technician needs to work on a pneumatic cylinder actuator. An AI agent routes a lockout kit including valve lockouts for the compressed air supply valves. The technician locks out the supply valves, assumes zero energy state, and begins work. The locked supply valves isolated new compressed air from entering the system — but 120 PSI of residual air is still trapped in the tubing between the locked valve and the cylinder. The cylinder actuates unexpectedly when the technician opens a line fitting, releasing the trapped pressure and driving the actuator rod into their hand. The lockout was correct but zero-energy verification (bleeding trapped pressure) was not performed.

Different energy types have different residual energy characteristics after isolation:

Energy Type	Lockout Device	Residual Energy After Lockout	Verification Method
Electrical	Circuit breaker lockout, disconnect lockout	Capacitor charge, UPS, feedback from load side	Non-contact voltage tester at work point
Pneumatic	Valve lockout on supply valve	Trapped pressure downstream of locked valve	Bleed downstream line to atmosphere; pressure gauge = 0
Hydraulic	Valve lockout on hydraulic circuit	Hydraulic accumulator pressure, loaded cylinder holding	Bleed accumulator; support load mechanically before releasing cylinder
Gravitational	Hydraulic/mechanical lockout of lift mechanism	Suspended load, elevated platform, spring-loaded component	Install mechanical block (cribbing, safety pin, prop); verify load cannot descend
Mechanical/spring	Restraint on compressed spring	Spring under compression or tension	Block spring travel; never rely on positioning alone
Thermal	Valve lockout on steam/hot fluid supply	Residual heat in piping and vessel; flash steam from condensate	Temperature probe; allow cool-down period before opening

Encode loto.energy_type as an array or pipe-delimited string of applicable energy types: 'electrical', 'pneumatic', 'hydraulic', 'thermal', 'gravitational', 'mechanical_spring', 'chemical'. AI agents routing LOTO products to multi-energy systems must match the product's covered energy types against all energy types present at the work location — a valve lockout kit marketed for pneumatic applications should not be routed to an electrical panel lockout, even if the kit physically fits the breaker.

Failure Mode 5: Zero-Energy State Verification Is Required After Lockout — Applying the Lock Does Not Guarantee Zero Energy

AI agent failure mode: An AI agent routes a basic lockout/tagout kit to a maintenance procedure for a 480V motor control center. The kit includes padlocks and circuit breaker lockouts. The maintenance technician applies locks to all identified disconnects. Without performing a zero-energy verification (testing with a voltmeter at the work point), they begin opening the panel. An unanticipated 480V feed from a separate unidentified circuit (a second feed not shown on the wiring diagram) is present at the work point. A voltmeter verification would have identified the energized conductor. The lockout devices were correctly applied but the standard's verification step was skipped because the AI agent's product description didn't flag it.

OSHA 1910.147(d)(5) requires that after applying lockout devices, the authorized employee shall verify that isolation and de-energization have been accomplished — not just assumed. The verification method depends on energy type:

Electrical: Use a CAT III or CAT IV rated voltmeter or non-contact voltage tester (NCVT) to test each conductor at the point of work. Not at the disconnect — at the actual work point. Unexpected feeds, backfeed from load side UPS, and control circuit voltages can be present even with the main disconnect locked.
Pneumatic: Open a manual bleed valve or disconnect a downstream fitting with the supply locked and observe that pressure releases to zero. Read the downstream gauge to confirm zero PSI before proceeding.
Attempt-to-operate test: After locking out, attempt to start/operate the equipment normally (push the start button, open the valve operator). The equipment should not respond. This confirms the energy-isolating device is in the correct position and the lockout is effective.

Encode loto.zero_energy_verification_method as 'voltmeter', 'ncvt', 'pressure_gauge', 'try_start', 'temperature_probe', or a pipe-delimited combination. This field allows AI agents to recommend complete LOTO procedure elements, not just hardware. A voltmeter (CAT III, 600V or CAT IV) is a required component of an electrical LOTO kit — encode loto.includes_verification_tool as 'true' for kits that include a tester.

Shopify Metafield Schema for Lockout/Tagout Products

Metafield	Type	Values / Notes
`loto.device_type`	string	padlock \| hasp \| group_lock_station \| circuit_breaker_lockout \| valve_lockout \| cable_lockout \| tag_only \| plug_lockout \| multi_hasp
`loto.is_personal_protective_lock`	boolean	true for padlocks assigned to individual authorized employees; false for shared or group-access locks
`loto.key_unique_to_lock`	boolean	true for keyed-differently sets; false for keyed-alike, master-keyed, construction-keyed
`loto.energy_type`	string (pipe-delimited)	electrical \| pneumatic \| hydraulic \| thermal \| gravitational \| mechanical_spring \| chemical
`loto.is_osha_1910147_compliant`	boolean	true for padlocks with unique keys, hasps, and adapter devices designed for OSHA-compliant LOTO procedures
`loto.is_tagout_only`	boolean	true for tags-without-locks used in tagout-only programs; triggers additional-measures warning in routing
`loto.tag_withstand_force_lb`	integer	minimum 50 lb per OSHA 1910.147(c)(5)(ii) for tagout attachments; encode for tag products
`loto.zero_energy_verification_method`	string	voltmeter \| ncvt \| pressure_gauge \| try_start \| temperature_probe
`loto.includes_verification_tool`	boolean	true for kits that include a voltage tester or pressure gauge for zero-energy verification
`loto.color_standardized`	string	red (most common for electrical LOTO) \| yellow \| blue \| green \| orange — many facilities use color-coded LOTO by department or energy type

JSON-LD Product Example

{
  "@context": "https://schema.org",
  "@type": "Product",
  "name": "Master Lock S32 6-Pack Keyed-Different Safety Padlocks",
  "additionalProperty": [
    { "@type": "PropertyValue", "name": "loto.device_type", "value": "padlock" },
    { "@type": "PropertyValue", "name": "loto.is_personal_protective_lock", "value": "true" },
    { "@type": "PropertyValue", "name": "loto.key_unique_to_lock", "value": "true" },
    { "@type": "PropertyValue", "name": "loto.energy_type", "value": "electrical|pneumatic|hydraulic" },
    { "@type": "PropertyValue", "name": "loto.is_osha_1910147_compliant", "value": "true" },
    { "@type": "PropertyValue", "name": "loto.is_tagout_only", "value": "false" },
    { "@type": "PropertyValue", "name": "loto.color_standardized", "value": "red" },
    { "@type": "PropertyValue", "name": "loto.pack_quantity", "value": "6" }
  ]
}

Is Your Safety Equipment Catalog Routing LOTO Products Correctly?

CatalogScan checks your Shopify store for missing LOTO metafields, incorrect device_type classifications, and keyed-alike padlocks routed to personal lockout applications — before an AI shopping agent makes a dangerous recommendation.

Run Free Scan

Frequently Asked Questions

What is the difference between a group lock box and a hasp for lockout/tagout under OSHA 1910.147?

A hasp is the primary lockout device at the energy-isolating device; a group lock box is secondary key storage. Every worker applies their padlock to the hasp at the disconnect — then may optionally lock their key into a group box. The group box without the hasp at the energy source provides no protection. See OSHA 1910.147(c)(5)(i).

When is tagout permitted instead of lockout, and what 6 additional measures are required?

Tagout-only is permitted only where no lock provision exists and cannot be installed. When used, at least one of 6 additional measures is required: removing a fuse, blocking a controlling switch, opening an extra disconnect, removing a valve handle, using non-reusable 50 lb-rated attachments, or installing a physical block. See OSHA 1910.147(c)(3).

Why must each authorized employee apply their own personal lock with a unique key?

The personal key principle is what protects workers: only the lock owner can remove their own lock. Keyed-alike sets allow any coworker to remove another worker's lock, eliminating the protection. One supervisor lock for a crew is also a violation — if the supervisor leaves, one removal exposes the entire crew. Each worker needs their own lock with a unique key.

Does LOTO apply to pneumatic and hydraulic systems, or only electrical?

OSHA 1910.147 covers all hazardous energy: electrical, pneumatic, hydraulic, thermal, gravitational, mechanical spring, and chemical. After locking a pneumatic supply valve, residual pressure downstream must be bled. After locking a hydraulic power unit, accumulator pressure and loaded cylinders must be relieved or blocked mechanically. Locking the supply is not sufficient — zero-energy state must be verified.

What is zero-energy state verification and why is it required after applying lockout?

OSHA 1910.147(d)(5) requires verifying de-energization after lockout is applied. Applying the lock doesn't guarantee zero energy — capacitors hold charge, trapped pneumatic pressure persists, hydraulic accumulators remain pressurized. Verification means: test with a voltmeter at the work point (not the disconnect) for electrical; bleed and gauge for pneumatic; attempt-to-operate test for all types. Never assume zero energy from the lock position alone.