Servicing and maintenance injuries share a shape. Energy that should have been isolated was not, or was isolated and came back, or was never recognised as energy at all because nothing was plugged in. The mechanism is usually simple to state. The contested question is where responsibility sits — with a machine that permitted the release, a procedure that never identified the source, or a worker who departed from a procedure that did. The hierarchy of controls is what disciplines that argument.
Unexpected startup is a category, not an event
OSHA's energy control standard at 29 CFR 1910.147 exists because energisation during servicing is foreseeable rather than freakish. The routes are distinguishable and each leaves its own evidence: somebody operated a control believing the area was clear; an automatic sequence resumed on a timer; a shared header fed the machine from a source nobody isolated; or a control-circuit fault produced an uncommanded output.
The distinction is not academic, because the remedies differ. Stopping a machine at its control circuit is not isolating it, and an investigation treating a stop button and a disconnect as equivalent has already gone wrong.
Stored energy does not need a power source
Hydraulic accumulators and trapped line pressure. Compressed air behind a closed valve. Springs under compression in a clamp or brake. Gravity acting on a raised platen or a counterweight. Rotational inertia in a flywheel. Tension in a conveyor take-up. None of it requires the machine to be energised, and all of it can injure somebody after the lights are off.
The standard requires such energy be relieved, restrained or otherwise rendered safe, and that isolation then be verified before work begins. Verification is the step most often skipped, and the one designed to catch exactly this.
The procedure is a document with a defined scope
Energy control procedures are meant to be machine-specific: each energy source identified, each isolation point named, the sequence of shutdown, isolation, dissipation and verification set out. A generic plant-wide procedure applied to a machine with an unlisted source is a documentable gap independent of anyone's conduct.
The comparison worth making is procedure against machine as built, not as drawn. Retrofits are where this comes apart — an added hydraulic power unit, a pneumatic supply run for a later fixture, a second feed added when the cell grew.
Minor servicing and the exception that gets stretched
The standard exempts minor tool changes and adjustments that are routine, repetitive and integral to production, provided alternative measures give effective protection. A meaningful share of servicing injuries occur inside that exception, because what counts as routine expands until most maintenance is done under it.
The forensic test is whether alternative protection existed and functioned, not whether the task can be called minor. Consensus guidance on alternative methods, including ANSI/ASSP Z244.1, frames this as an analysis to be documented rather than a judgement made at the machine.
Group lockout, shift change and contractors
Servicing performed by more than one person, across more than one shift, or by more than one employer is where energy control most often breaks down. Group lockbox arrangements, personal locks, continuity of isolation across a handover, and host-contractor coordination each leave documentary traces: the box, the tags, the permit, the sign-on record.
Those records also establish who knew what. A contractor working to the host's procedure and one working to its own, on the same machine the same day, recurs.
Training is tested against the task, not the roster
The standard distinguishes authorised employees who perform isolation, affected employees who operate the equipment, and others in the area, with different obligations for each. A signature on an attendance sheet evidences attendance, not competence.
Stronger evidence is content and verification: whether training was machine-specific or generic, whether it was hands-on, whether the periodic inspection of the procedure was performed with the authorised employee, and whether it was delivered in a language the worker read.
The hierarchy of controls decides where attribution lands
Elimination, substitution, engineering controls, administrative controls, then personal protective equipment. ISO 12100 expresses the same discipline as a three-step method: inherently safe design first, then safeguarding and complementary protective measures, then information for use. The ordering is a statement about reliability — controls near the top do not depend on a person behaving as expected under production pressure.
Procedure and training are administrative controls, the second-least reliable tier. Where one is the only thing between stored energy and a person, its eventual failure is foreseeable, and the question of why nothing higher was applied comes first in the analysis.
Why 'the procedure was not followed' is incomplete
It can be entirely true and still not be the answer. Was compliance feasible in the time the task was allowed? Did the isolation points physically exist, and were they reachable and capable of accepting a lock? Had deviation become the observed norm, tolerated by supervision and visible in prior audits?
The converse holds too. Not every departure is systemic. What separates the two is pattern evidence — prior incidents, audit findings, work orders, the observed practice of others on the same machine.
What a defensible analysis states
The energy source and its path to the point of injury. The isolation points that existed, and whether they were lockable and reachable. What the procedure required and whether it matched the machine as built. And the level in the hierarchy at which the failure sits.
The challenges are predictable: that cause was assigned to human error without testing whether compliance was feasible, and that conclusions came from a procedure nobody compared against the machine it described.
This article is general technical orientation, not a failure analysis, an engineering opinion, or advice on any specific matter. Determining the cause of a particular incident requires hands-on examination by a credentialed expert.