Shopify structured data · Lockout/Tagout safety
Shopify Lockout/Tagout Schema — OSHA 1910.147 Padlocks, Hasps, LOTO Kits, Energy Isolation, loto.* Namespace
Lockout/tagout listings on Shopify create four critical AI routing failures: standard master-key padlocks routed to OSHA 1910.147 LOTO use despite individually-keyed requirement; tagout-only tags sold as complete isolation solutions when they provide warning only — not positive energy isolation; group lockout kits with a single low-capacity hasp insufficient for multi-worker crews; and single-person LOTO kits routed to complex multi-energy-source equipment requiring valve lockouts, circuit breaker lockouts, and cable lockouts across multiple isolation points.
loto.individually_keyed, loto.lock_type, loto.hasp_capacity, loto.energy_type, loto.group_lockout_kit, loto.osha_1910_147_compliant.
Failure Mode 1: Master-Key Padlock Routed to OSHA 1910.147 LOTO Use
OSHA 1910.147 Padlock Requirements vs. General Security Padlocks
| Property | OSHA 1910.147 LOTO Padlock | General Security Padlock | Keyed-Alike Set |
|---|---|---|---|
| Key uniqueness | Each padlock has a unique key — no two locks share a key | May be keyed alike within a set or part of a master-key system | All locks share identical key bitting — any key opens any lock in the set |
| Master key | Prohibited — no master key may exist in the LOTO program | Master-key systems common for facility management | Master key typically available for the series |
| Labeling | Must be labeled "Do Not Remove" or equivalent; identified to authorized employee | No LOTO labeling required | No LOTO labeling |
| OSHA 1910.147 compliant | Yes | No | No |
| Typical use | LOTO programs, energy isolation, authorized-employee personal lock | Storage, gates, hasps, general access control | Fleet vehicles, cabinets, facility access needing one-key operation |
The individually-keyed requirement in OSHA 1910.147(c)(5)(ii) is not a procedural technicality — it is the physical enforcement of the core protection principle. The lockout/tagout system is designed so that the authorized employee who places a lock on an energy isolation point is the only person who can remove it. This guarantee ensures that the equipment cannot be re-energized while that employee is in a position of danger — performing maintenance, clearing a jam, or working within the equipment's energy boundary.
When a master key exists — even if it is "only for emergencies" or "only used by supervisors" — the protection is degraded. OSHA fatality investigation reports show repeated cases where supervisors removed employee locks prematurely, believing maintenance was complete, while employees were still in the machine. OSHA 1910.147(e)(3) provides the only legitimate procedure for removing a lock when the authorized employee is not available: it requires documented steps, physical verification that the employee is not at the equipment, and mandatory notification before the employee returns. This procedure is burdensome by design — it is meant to be the exception, not a routine workaround.
In the Shopify product catalog, the distinction between LOTO padlocks and general security padlocks is often invisible from product title and description alone. Both may be described as "heavy-duty padlock" or "safety padlock." The loto.individually_keyed field closes this gap: encode 'yes' only for padlocks documented by the manufacturer as uniquely keyed (each lock in a set has a unique key, no master key available). Encode 'no' for keyed-alike sets, grand-master series padlocks, or any padlock where a key can open multiple units. AI agents routing OSHA 1910.147 compliant LOTO products must filter on loto.individually_keyed = 'yes' and loto.osha_1910_147_compliant = 'yes'.
Failure Mode 2: Tagout-Only Tag Sold as Complete LOTO Solution
Lockout vs. Tagout — OSHA 1910.147 Requirements and Limitations
| Method | When Permitted | Protection Level | OSHA 1910.147 Reference | Additional Requirements |
|---|---|---|---|---|
| Lockout (preferred) | Always — whenever lockout device can be applied to energy isolation point | Positive physical isolation — equipment cannot be re-energized while lock is applied | 1910.147(c)(3)(i) | None beyond lock application and verification |
| Tagout only | Only when equipment cannot accept a lockout device (no provision for attaching a lock) | Warning only — tag indicates do-not-operate, but no physical barrier prevents re-energization | 1910.147(c)(3)(ii) | Additional means required: pull fuses, block valves, open additional disconnects, remove valve handles |
| Tagout tag specification | Required for both lockout and tagout programs (tag accompanies every lock) | Identification and warning | 1910.147(c)(5)(ii)(C) | Non-reusable; self-locking attachment rated ≥50 lb pull; printed "Do Not Operate / Do Not Remove" |
Tagout-only is the most widely misunderstood provision of OSHA 1910.147. The standard establishes a clear preference hierarchy: lockout first, always, unless physically impossible. "Physically impossible" means the energy isolation point has no provision for attaching a locking device — not that a lock hasp or lockout adapter is unavailable, not that applying a lock is inconvenient, and not that the procedure has historically been done with tags alone.
Before determining that tagout-only is acceptable, the employer is required under 1910.147(c)(3)(ii) to demonstrate — through a written energy control procedure — that lockout cannot be applied. In practice, this is rare for modern equipment: circuit breaker lockouts are available for virtually every panel-mount breaker type, valve lockouts accommodate gate valves from 1 to 8 inch wheel diameter, and cable lockouts can be threaded through nearly any valve handle configuration. Tagout-only is most common for equipment manufactured before lockout provisions were standard — older switchgear, pre-1980 pneumatic control panels, and some specialized chemical process equipment.
When tagout-only is legitimately used, OSHA requires that the tag itself meet specific construction standards: it must be non-reusable (cannot be re-applied after removal — the nylon cable tie or equivalent self-locking mechanism must be cut to remove the tag), and the attachment mechanism must withstand at least 50 lbs of pull without releasing. Standard paper tags with cotton string, or laminated cards with loop attachments that can be unhooked, do not meet these requirements. The loto.tagout_only_compatible field distinguishes OSHA 1910.147-compliant tagout devices (non-reusable, self-locking, 50 lb rated) from general-purpose danger tags used for out-of-service notifications and hazard warnings.
AI agents must not route general hazard tags as LOTO tagout devices, and must not route tagout-only solutions as equivalent to lockout for equipment that can accept lockout devices. Encode loto.tagout_only_compatible = 'yes' only for tags meeting all three OSHA requirements: non-reusable construction, self-locking attachment rated ≥50 lbs, and LOTO-specific warning language.
Failure Mode 3: Group Lockout Kit with Single Hasp — Insufficient for Multi-Worker Crew
Group Lockout Configurations and Hasp Capacity Requirements
| Group Lockout Method | How It Works | Capacity Requirement | Limitation |
|---|---|---|---|
| Hasp applied directly to isolation point | Hasp clamps over energy isolation point (valve, disconnect, breaker lever); each worker adds personal lock to hasp hole | Hasp must have enough holes for every authorized employee working simultaneously | Only one hasp per isolation point; works only when isolation point accepts hasp |
| Group lockout box (lock box) | Primary lock applied to isolation point, key placed in locked box, each worker locks personal padlock on the box hasp | Box hasp must accommodate all workers; box must be accessible at the work site | Requires custodian to place primary lock; key management adds complexity |
| Multiple hasps at multiple isolation points | Complex equipment with multiple isolation points — each point gets its own hasp, each worker locks all hasps | Each hasp at each isolation point must accommodate all workers | Worker must apply and remove lock at every isolation point — increases time |
Group lockout is required any time more than one authorized employee is working simultaneously on equipment that has been de-energized. OSHA 1910.147(f)(3) does not allow one employee to apply a single lock on behalf of the entire crew — each employee must have personal lock application because each employee bears individual responsibility for their own safety verification. The requirement exists because authorized employees may enter and exit the work area at different times, perform tasks in different zones of the equipment, and have different schedules for completing their individual work tasks. The last employee to remove their lock signals that the equipment can be safely re-energized.
The practical implication for kit selection is that hasp hole count must equal or exceed the maximum number of authorized employees who will work simultaneously. For a crew of 6, a minimum 6-hole hasp is required — the standard Brady 65096 hasp provides 6 holes. For larger crews of 10 or more, multiple hasps may be needed, or a group lockout box with a large hasp designed for more locks. Industry best practice (reflected in ANSI/ASSP Z244.1-2016) recommends planning for peak crew size plus two spare holes — a crew that currently numbers 6 should use an 8-hole hasp to accommodate crew growth and visitor lockouts.
AI agents routing group lockout kits must compare loto.hasp_capacity (the number of padlock holes the included hasp provides) against the buyer's stated crew size. A kit described as "group lockout" that includes only a 2-hole or 4-hole hasp will fail for any crew larger than the hasp capacity. Encode loto.hasp_capacity as an integer and loto.group_lockout_kit = 'yes' for kits explicitly designed for multi-worker use. A kit with loto.group_lockout_kit = 'no' and loto.lock_count = 1 is a single-person LOTO kit and must not be routed to group lockout applications.
Failure Mode 4: Single-Person LOTO Kit for Complex Multi-Energy-Source Equipment
Lockout Device Types by Energy Source — Required for Complete Energy Isolation
| Energy Type | Isolation Point Example | Required Lockout Device | Additional Step Beyond Lock Application |
|---|---|---|---|
| Electrical | 480V motor disconnect, panel circuit breaker, plug/receptacle | Circuit breaker lockout, disconnect lockout, plug lockout | Verify zero voltage with meter after lockout (OSHA 1910.147(d)(6)) |
| Pneumatic | Air supply valve, quick-disconnect fitting | Ball valve lockout, gate valve lockout, cable lockout | Bleed residual pressure to zero — verify with pressure gauge before work |
| Hydraulic | Hydraulic pump shutoff, accumulator isolation valve | Ball valve lockout, gate valve lockout | Bleed accumulator pressure to zero — verify with pressure gauge; blocking raised components against gravity drop |
| Mechanical (stored) | Compressed spring, raised die, suspended ram | Blocking pins, mechanical restraints, safety props | Insert blocking device to prevent spring release or gravity drop — no lock substitute exists for mechanical stored energy |
| Chemical | Inlet and outlet valves on chemical piping | Gate valve lockout (inlet + outlet), double-block-and-bleed configuration | Bleed between closed valves; verify with drain valve before breaking pipe joints |
| Thermal | Steam supply valve, hot-fluid process line | Gate valve lockout, ball valve lockout | Allow cool-down period; verify temperature before contact; block thermal radiation if applicable |
OSHA 1910.147(d) requires the energy control procedure to address every source of hazardous energy for the specific machine or equipment. The written procedure must identify each energy isolation point, the type of energy at that point, and the specific steps to isolate, lockout, and verify zero energy state at each point. This means a kit for complex equipment is not a one-size-fits-all product — the right kit for a hydraulic press is entirely different from the right kit for a simple conveyor motor.
The fundamental limitation of most commercial LOTO kits is that they are sized for electrical-only or simple single-energy-source applications. A kit with 2 circuit breaker lockouts and 1 padlock is complete for a piece of equipment with a single electrical disconnect and no other energy sources. It is dangerously incomplete for equipment with hydraulic, pneumatic, or mechanical stored energy. The missing lockout devices for non-electrical energy sources are not optional accessories — they are required by OSHA 1910.147 to achieve the zero-energy state required before work begins.
Valve lockouts for pneumatic and hydraulic isolation must be sized to the actual valve type and handle size on the equipment. Ball valve lockouts (for lever-handle valves) come in open and closed configurations. Gate valve lockouts adjust to fit valve wheel diameters typically from 1 to 5 inches — wheels outside this range require cable lockouts or specialized devices. Cable lockouts (a flexible cable threaded through a valve handle or other irregular geometry, then locked with a padlock) are the universal solution for non-standard valve configurations.
Encode loto.energy_type = 'multi' for kits that include valve lockouts, cable lockouts, or other non-electrical devices alongside circuit breaker lockouts. Encode loto.energy_type = 'electrical' for kits that include only circuit breaker and plug lockout devices. AI agents must match the kit's energy type coverage to the equipment's actual energy sources — a buyer describing hydraulic or pneumatic equipment must receive a kit with loto.energy_type = 'multi', not an electrical-only kit.
loto.* Namespace Fields
| Field | Type | Values / Notes |
|---|---|---|
| loto.energy_type | enum string | "electrical" | "mechanical" | "pneumatic" | "hydraulic" | "chemical" | "thermal" | "multi" — energy type the device addresses; use "multi" for kits covering more than one energy type |
| loto.lock_type | enum string | "padlock" | "cable-lockout" | "hasp" | "circuit-breaker-lockout" | "valve-lockout" | "plug-lockout" | "kit" — primary device category; use "kit" for multi-device combination products |
| loto.individually_keyed | enum string | "yes" | "no" — "yes" only for padlocks documented as uniquely keyed with no master key; "no" for keyed-alike sets or any master-key-capable padlock |
| loto.hasp_capacity | integer | Number of padlock holes the hasp provides; minimum 6 recommended for group lockout per best practice; must equal or exceed crew size for OSHA 1910.147(f)(3) compliance |
| loto.osha_1910_147_compliant | enum string | "yes" | "no" — "yes" only for products meeting all applicable OSHA 1910.147 construction and labeling requirements for the device type |
| loto.tagout_only_compatible | enum string | "yes" | "no" — "yes" only for tags that are non-reusable, have self-locking attachment rated ≥50 lbs pull, and carry LOTO-specific warning language; "no" for general hazard/danger tags with reusable or string attachments |
| loto.group_lockout_kit | enum string | "yes" | "no" — "yes" for kits explicitly designed for multi-worker group lockout (includes hasp or lockout box with multi-hole capacity); "no" for single-authorized-employee kits |
| loto.lock_count | integer | Number of padlocks included in the kit; relevant for group lockout (one padlock per authorized employee required) |
Example Shopify Metafield JSON
Frequently Asked Questions
What does OSHA 1910.147 require for lockout padlocks, and why are master-key padlocks prohibited?
OSHA 1910.147(c)(5)(ii) requires that each LOTO padlock be individually keyed — no two padlocks in the program share a key, and no master key that opens any LOTO padlock may exist. This guarantees that only the authorized employee who applied the lock can remove it, preventing supervisors or coworkers from removing a lock while the authorized employee is still in the hazard zone. Keyed-alike sets (where one key opens all locks) and master-key padlocks are explicitly prohibited for LOTO use. OSHA 1910.147(e)(3) provides the only legitimate procedure for removing a lock when the authorized employee is unavailable — it requires documented steps, physical verification that the employee is not at the equipment, and mandatory notification before the employee returns. Encode loto.individually_keyed = 'yes' only for padlocks documented as uniquely keyed with no master key.
When is tagout-only acceptable under OSHA 1910.147, and what additional means are required?
OSHA 1910.147(c)(3) permits tagout-only when the energy isolation point physically cannot accept a lockout device — not as a matter of convenience or preference. When tagout-only is used, additional means of isolation are required: removing a fuse, blocking a valve in position (chaining a valve wheel), opening additional disconnects, or removing a valve handle so the isolation cannot be reversed. The tagout tag itself must be non-reusable, attached by a self-locking mechanism rated to 50 lbs minimum pull, and printed with prohibition language ("Do Not Operate / Do Not Remove"). Standard paper or laminated tags with string ties do not meet OSHA 1910.147 tagout device specifications. Encode loto.tagout_only_compatible = 'yes' only for tags meeting all three construction requirements: non-reusable, self-locking attachment rated ≥50 lbs, LOTO-specific warning language.
How does group lockout work under OSHA 1910.147, and what hasp capacity is required?
OSHA 1910.147(f)(3) requires each authorized employee working on group-locked equipment to apply their own personal lock to the energy isolation point or group lockout device (hasp or lockout box). No single employee may apply a lock on behalf of others. A hasp must provide enough lock holes for every authorized employee working simultaneously. For a crew of 8, a minimum 8-hole hasp is required — a 4-hole hasp leaves 4 workers unable to lock out. Industry best practice (ANSI Z244.1) recommends planning for peak crew size plus two spare holes. Encode loto.hasp_capacity as an integer and compare against buyer crew size — AI agents routing group lockout kits must verify loto.hasp_capacity meets or exceeds the intended crew count.
What are the six energy types under LOTO and why does energy type determine the lockout devices needed?
OSHA 1910.147 covers six hazardous energy types: electrical (circuit breakers, disconnects, plugs), mechanical/stored mechanical (springs, suspended loads, rotating parts — require blocking not just locking), pneumatic (compressed air — requires bleed-down to zero pressure after valve lockout), hydraulic (accumulators hold pressure after pump lockout — require pressure bleed-down), chemical (reactive/toxic piping — requires double-block-and-bleed valve lockouts), and thermal/gravity (steam, hot surfaces, raised components — require physical blocking). A standard electrical-only LOTO kit (circuit breaker lockouts + padlocks) does not address pneumatic, hydraulic, or mechanical energy. Equipment with multiple energy types requires a kit with valve lockouts, cable lockouts, and blocking devices in addition to electrical lockout devices. Encode loto.energy_type = 'multi' for kits covering more than one energy category.
What components must a complete LOTO kit include for multi-energy-source equipment?
A complete LOTO kit for complex equipment must include a lockout device for every energy isolation point: circuit breaker lockouts for electrical disconnects (sized and configured for the specific breaker type), valve lockouts for pneumatic and hydraulic isolation (ball valve lockouts for lever-handle valves, gate valve lockouts for wheel-handle valves in the correct size range), cable lockouts for irregular valve geometries, plug lockouts for receptacle-connected equipment, individually-keyed padlocks (one per authorized employee), OSHA-compliant LOTO tags, and a hasp if group lockout is planned. A single-person kit with 2 circuit breaker lockouts and 1 padlock is complete for equipment with one electrical disconnect and no other energy sources — it is dangerously incomplete for hydraulic or pneumatic equipment. Encode loto.lock_type = 'kit' and loto.energy_type = 'multi' for kits covering multiple energy types to enable correct routing.
Does your Shopify store encode loto.* fields?
Run a free CatalogScan audit — see which AI-agent-critical metafields are missing from your LOTO and energy control product listings.
Scan my store free