Group Lockout Tagout and Shift Changes: Maintaining Every Worker's Protection

An outage can start with one maintenance crew and end with several trades across two shifts. Energy isolation must remain effective when the original coordinator leaves (1910.147(f)(4)). The employer needs a procedure that identifies every exposed worker, preserves each person's protection and transfers responsibility without leaving an unprotected interval.

For general-industry servicing covered by 29 CFR 1910.147, paragraph (f)(3) governs group protection and (f)(4) governs shift or personnel changes. A group lockbox is one way to implement an appropriate procedure. The box alone does not demonstrate that the isolation is complete.

Establish the applicable energy-control requirements

Section 1910.147 addresses servicing and maintenance where unexpected energization, startup or release of stored energy could injure employees. Its scope includes defined normal-production servicing situations and contains specific exclusions and exceptions. The minor-servicing exception is conditional; it is not a general permission to clear jams under an emergency stop.

Construction employment is excluded from 1910.147. Apply the construction provisions relevant to the task, such as 1926.417 for covered electrical circuit controls and 1926.555(a)(7) for conveyor repair. Electrical-shock hazards in general-industry electric-utilization installations are addressed by Subpart S, including 1910.333. A site may also adopt a broader company policy, clearly identified as such.

Before selecting a group arrangement, identify electrical, pneumatic, hydraulic, gravity, thermal, mechanical and process-related hazards. A stopped motor, a dark display or an open interlocked gate does not establish isolation. Push buttons and other control-circuit devices are not energy-isolating devices under 1910.147(b).

Assign the group roles before anyone starts

Under 1910.147(f)(3), group procedures must provide protection equivalent to personal lockout or tagout. The procedure must assign primary responsibility to an authorized employee for the defined group and provide a way for that employee to ascertain group members' exposure status. When several crews, departments or groups are involved, assign an overall coordinator to ensure continuity of protection.

Under 1910.147(f)(3), each authorized employee must attach a personal lockout or tagout device to the group device, group lockbox or comparable mechanism when starting work and remove it when stopping work. An attendance list, contractor badge or coordinator signature does not replace the individual's protection. Where equipment can be locked out, the standard's lockout preference and conditional tagout provisions still apply.

The on-site and outside employers must exchange their respective energy-control procedures under 1910.147(f)(2). The on-site employer must ensure its employees understand and comply with the outside employer's program restrictions and prohibitions. Resolve conflicting lock identification, key custody and handover methods before the job.

Verify the isolation and control changes

Follow the machine-specific procedure: prepare, shut down, isolate, apply the devices, control stored energy and verify isolation before servicing. Verification must address the actual energy sources. If stored energy can reaccumulate to a hazardous level, continue verifying isolation until servicing ends or that possibility no longer exists, as 1910.147(d)(5)(ii) requires.

Provide participating authorized employees with the opportunity to verify effective isolation through the employer's group procedure. A coordinator's test does not justify withholding the information a worker needs to understand the isolation. Record changed equipment configurations and communicate them to everyone whose protection depends on the arrangement.

Group lockbox control and verification

A group lockbox allows several authorized employees to work under one coordinated energy-isolation arrangement. It is an acceptable method of group lockout; OSHA doesn't make every employer use one.

Example of a lock-based group procedure

1. An authorized employee follows the equipment-specific procedure to shut down and isolate all hazardous energy sources, apply the necessary equipment-isolation locks, control stored energy, and verify isolation.
2. The keys controlling those equipment-isolation locks are secured inside a group lockbox. The arrangement should prevent access to the keys while participating workers' personal locks protect the box. The employer's procedure should address control of duplicate keys.
3. The designated primary authorized employee coordinates the isolation, determines the exposure status of group members, and manages the work of participating crews.
4. Each authorized employee attaches a personal lock to the group lockbox when beginning work and removes it when stopping work. Workers retain control of their personal keys.
5. The responsible authorized employees account for the workers and devices before the group isolation is released.

This is one example. OSHA does not prescribe a particular box design, mounting position, or location.

Who verifies the isolation?

For complex group lockout operations, OSHA recognizes a procedure in which the primary authorized employee verifies effective isolation on behalf of the group. Under that approach, the primary employee completes verification before the participating employees attach their personal devices and begin servicing.

Every participating authorized employee must be informed of the opportunity to verify isolation personally and allowed to do so (OSHA interpretation 2023-07-27). An employee choosing individual verification must perform it after attaching their personal device to the group lockbox and before beginning work.

Attaching a lock to the box does not, by itself, verify that the equipment is de-energized.

These distinctions are explained in OSHA's July 27, 2023 interpretation and CPL 02-00-147.

Multiple crews and outside contractors

A large operation may use designated crew contacts to communicate worker status to the overall coordinator. The employer's procedure should explain how employees entering or leaving the group are accounted for.

A supervisor's lock or a signed roster cannot replace each participating authorized employee's personal device. OSHA explicitly rejected that substitution in its May 21, 2021 interpretation.

The lockbox method described here uses personal locks. Compliant group tagout arrangements are also possible, but tags do not physically restrain equipment or keys. Where tagout replaces lockout at a lockable energy-isolating device, the employer must satisfy 1910.147(c)(2) and (c)(3).

Shift changes: Maintaining protection without a gap

Under 29 CFR 1910.147(f)(4), employers must use specific procedures to maintain protection during shift or personnel changes, including an orderly transfer between outgoing and incoming employees.

The regulation does not prescribe one universal transfer method.

When shifts overlap

One workable procedure is for incoming authorized employees to attach their personal devices before outgoing employees remove theirs. The responsible authorized employees coordinate the transfer and confirm that protection remains continuous.

When shifts do not overlap

An employer may use a dedicated job lock, operations lock, or other continuity device under its established procedure.

For example, a job lock can keep a group lockbox secured after outgoing workers remove their personal devices and before incoming workers arrive.

The employer's procedure should address the transfer of responsibility, control of continuity-device keys, and the incoming group's verification arrangements.

Before servicing resumes, incoming workers must have the required personal protection and current assurance that energy isolation remains effective (1910.147(f)(3) and (f)(4)). For complex group operations, the employer may use the applicable primary-authorized-employee verification method, while giving participating authorized employees the opportunity to verify isolation themselves.

A continuity device is not a personal lock.

OSHA's enforcement guidance permits designated personnel to transfer or remove certain continuity devices under the employer's established procedure. That flexibility does not authorize routine removal of another worker's personal lock.

If an individual personal device remains attached and the employee is unavailable, use the applicable requirements of 1910.147(e)(3). See the existing HazComFast article, An Employee Went Home With Their Lock Still On. Who Can Remove It?.

Before restarting equipment

The authorized employees must complete the applicable release requirements of 1910.147(e), including:

• Inspecting the work area and confirming that nonessential items have been removed and equipment components are operationally intact.
• Ensuring employees have been safely positioned or removed.
• Removing lockout or tagout devices under the applicable rules.
• Notifying affected employees after device removal and before startup.

The employer's procedure should identify who coordinates the final release and authorizes return to service. Document the release in the format established by the energy-control program.

Practical group LOTO checklist

Use this checklist with the actual equipment-specific energy-control procedure.

Before work begins

• Identify the equipment, work scope, energy sources, and isolation points.
• Designate the primary authorized employee and establish crew coordination.
• Exchange applicable procedures with outside servicing employers.
• Isolate and secure every hazardous energy source.
• Control stored energy and verify effective isolation.
• Secure equipment-isolation keys in the group lockbox, if used.
• Ensure each participating authorized employee applies their personal device before starting work.
• Inform employees of their opportunity to verify isolation personally.

During work and shift changes

• Account for employees joining and leaving the protected group.
• Maintain protection throughout each employee's exposure.
• Continue verification where hazardous stored energy could reaccumulate.
• Communicate changed equipment conditions and unresolved hazards.
• Transfer protection between shifts without a gap.
• Complete the incoming group's applicable verification process before work resumes.

Before returning equipment to service

• Confirm that servicing has ended and participating workers have stopped work.
• Account for all personal devices and resolve discrepancies.
• Inspect the equipment and work area.
• Ensure employees are safely positioned or removed.
• Remove the remaining devices under the established procedure.
• Notify affected employees before startup.

This checklist is an employer-use aid. OSHA does not prescribe this exact checklist or call for a completed copy for every group lockout.

Example: Three crews working across two shifts

The following example is hypothetical.

A manufacturing plant shuts down a conveyor for bearing replacement, motor work, and pneumatic actuator repairs. Plant mechanics, an outside electrical contractor, and instrumentation technicians will work on the equipment.

The energy-control procedure identifies the electrical disconnect, compressed-air isolation valve, and a gravity-related hazard from a raised component. The appropriate sources are isolated, pneumatic pressure is relieved, and the raised component is secured.

The equipment-isolation locks are applied and their keys secured in a group lockbox. The primary authorized employee verifies effective isolation under the employer's procedure. Each participating authorized employee attaches a personal device before starting work.

The plant and outside electrical contractor exchange their applicable energy-control procedures.

The work continues into a second shift. A job lock already securing the group box maintains continuity while outgoing workers remove their personal devices. The incoming coordinator assumes responsibility, confirms the isolation status, and implements the applicable verification procedure. Incoming employees attach their own personal devices before working.

After the maintenance is complete, each employee removes their personal device. The responsible authorized employees perform the release checks of 1910.147(e) before restarting the conveyor.

Electrical-safety distinction: Exposure to electrical-shock hazards from work on or near conductors or equipment in electric-utilization installations is governed by OSHA Subpart S, including 1910.333, rather than 1910.147 for those electrical hazards. Other hazardous-energy exposures associated with servicing the machinery may remain subject to 1910.147.

Shift handover record template

This form is an example for employers developing shift-change procedures. OSHA requires effective continuity under 1910.147(f)(4), but it does not prescribe this form, these fields, or a universal handover-signature requirement.

Individual device accountability

Each entry should reflect the actual authorized employee's application or removal of their personal device. A roster entry or coordinator's signature does not substitute for that device.

Keep this record according to the employer's procedure. It is not an OSHA-mandated daily log.

Separately, 1910.147(c)(7) requires appropriate employee training, and 1910.147(c)(7)(iv) requires certification of training identifying employee names and training dates.

Missing employees, testing and final release

A supervisor cannot remove an absent worker's device merely because the shift has ended. Section 1910.147(e)(3) normally assigns removal to the employee who applied it. Its exception requires a documented employer procedure and training providing equivalent safety, including verification that the employee is not at the facility, reasonable efforts to contact the employee, and ensuring the employee knows of removal before resuming work there.

If equipment must be energized for testing or positioning, use the controlled sequence in 1910.147(f)(1): clear tools and materials, remove employees from the machine area, remove devices under the applicable requirements, energize only for the test, then deenergize and reapply energy controls before servicing continues. A temporary test is a distinct change of condition; preserve group accountability through it.

A shift handover form records the transfer. Resolve any isolation discrepancy before work resumes or equipment is released.

Questions supervisors should resolve at the handover

1. Which exact equipment and work remain within the isolation?
2. Who holds coordination responsibility now, and who is actually exposed?
3. Which physical devices preserve protection during the transfer?
4. What verification does the incoming group need to complete before work resumes?
5. What changed, including stored energy, disconnected lines and unfinished tests?
6. What discrepancy would keep work stopped until it is resolved?

Sources

• 29 CFR 1910.147, particularly (c), (d), (e) and (f).
• OSHA lockout tagout guidance.
• 29 CFR 1910.333, electrical safety-related work practices.