Is an unexpected machine startup during servicing a freak event?
No: unexpected startup during machine servicing is a category rather than a single freak event, and OSHA’s energy control standard at 29 CFR 1910.147 exists because energization during servicing is foreseeable. The routes to unexpected startup are distinguishable, and each leaves its own evidence: somebody operated a control believing the area was clear; an automatic sequence resumed on a timer; a shared header fed the machine from a source nobody isolated; or a control-circuit fault produced an uncommanded output.
The distinction between the routes to unexpected startup is not academic, because the remedies differ. Stopping a machine at its control circuit is not isolating the machine, and an investigation that treats a stop button and a disconnect as equivalent has already gone wrong.
Can a machine injure someone after its power is off?
Yes: stored energy does not need a power source, and it can injure somebody after the lights are off. Hydraulic accumulators and trapped line pressure, compressed air behind a closed valve, springs under compression in a clamp or brake, gravity acting on a raised platen or a counterweight, rotational inertia in a flywheel, and tension in a conveyor take-up are all stored energy, and none of it requires the machine to be energized.
OSHA’s energy control standard, 29 CFR 1910.147, requires that stored energy be relieved, restrained or otherwise rendered safe, and that isolation then be verified before work begins. Verification of isolation is the step most often skipped, and it is the step designed to catch exactly this kind of stored energy.
What is an energy control procedure supposed to cover?
An energy control procedure is meant to be machine-specific: it identifies each energy source, names each isolation point, and sets out the sequence of shutdown, isolation, dissipation and verification for that machine. A generic plant-wide energy control procedure applied to a machine with an unlisted energy source is a documentable gap independent of anyone’s conduct.
The comparison worth making is the energy control procedure against the machine as built, not as drawn. Retrofits are where the energy control procedure and the machine come apart: an added hydraulic power unit, a pneumatic supply run for a later fixture, or a second feed added when the cell grew.
When does the minor servicing exception to lockout apply?
The minor servicing exception in OSHA’s energy control standard, 29 CFR 1910.147, applies to minor tool changes and adjustments that are routine, repetitive and integral to production, provided alternative measures give effective protection. A meaningful share of servicing injuries occur inside the minor servicing exception, because what counts as routine expands until most maintenance is done under it.
The forensic test for the minor servicing exception is whether alternative protection existed and functioned, not whether the task can be called minor. Consensus guidance on alternative methods, including ANSI/ASSP Z244.1, frames the question of alternative protection as an analysis to be documented rather than a judgment made at the machine.
Where does energy control most often break down during servicing?
Energy control most often breaks down where servicing is performed by more than one person, across more than one shift, or by more than one employer. Group lockbox arrangements, personal locks, continuity of isolation across a shift handover, and host-contractor coordination each leave documentary traces: the lockbox, the tags, the permit and the sign-on record.
Group lockout, shift-change and contractor records also establish who knew what. A contractor working to the host employer’s energy control procedure and another working to its own, on the same machine on the same day, is a situation that recurs.
How is lockout training judged after a servicing injury?
Energy control training is tested against the task the worker performed, not against the training roster, because a signature on an attendance sheet evidences attendance, not competence. OSHA’s energy control standard, 29 CFR 1910.147, distinguishes authorized employees who perform isolation, affected employees who operate the equipment, and others in the area, with different obligations for each.
Stronger evidence of energy control training is its content and verification: whether the training was machine-specific or generic, whether it was hands-on, whether the periodic inspection of the energy control procedure was performed with the authorized employee, and whether the training was delivered in a language the worker read.
How does the hierarchy of controls decide where attribution lands?
The hierarchy of controls decides where attribution lands because its ordering is a statement about reliability: controls near the top do not depend on a person behaving as expected under production pressure. The hierarchy of controls runs elimination, substitution, engineering controls, administrative controls, then personal protective equipment, and ISO 12100 expresses the same discipline as a three-step method: inherently safe design first, then safeguarding and complementary protective measures, then information for use.
Procedure and training are administrative controls, the second-least reliable tier of the hierarchy of controls. Where a procedure or training is the only thing between stored energy and a person, its eventual failure is foreseeable, and the question of why nothing higher in the hierarchy of controls was applied comes first in the analysis.
Is “the procedure was not followed” a complete explanation for a servicing injury?
Not by itself: a finding that “the procedure was not followed” can be entirely true and still not be the answer. The questions that remain are whether compliance was feasible in the time the task was allowed, whether the isolation points physically existed and were reachable and capable of accepting a lock, and whether deviation had become the observed norm, tolerated by supervision and visible in prior audits.
The converse holds too: not every departure from an energy control procedure is systemic. What separates a systemic failure from an individual departure is pattern evidence — prior incidents, audit findings, work orders, and the observed practice of others on the same machine.
What should a defensible analysis of a stored-energy injury state?
A defensible analysis of a stored-energy or unexpected-startup injury states the energy source and its path to the point of injury, the isolation points that existed and whether they were lockable and reachable, what the energy control procedure required and whether it matched the machine as built, and the level in the hierarchy of controls at which the failure sits.
The challenges to an analysis of a stored-energy or unexpected-startup injury are predictable: that cause was assigned to human error without testing whether compliance was feasible, and that conclusions came from an energy control procedure nobody compared against the machine it described.
This article is general technical orientation, not a failure analysis, an engineering opinion, or advice on any specific matter. Determining the cause of a particular incident requires hands-on examination by a credentialed expert.