A stopped machine can still carry enough electrical, pneumatic, hydraulic, gravitational, spring, thermal, or inertial energy to injure a worker. Pressing an emergency stop changes the control state; it does not necessarily isolate power, dissipate stored energy, restrain motion, or prevent energy from returning. The number that matters is the energy at the point of work after shutdown—not the worker’s job title.
Wrong fixes for the operations-maintenance boundary
Several familiar measures fail when they are used as substitutes for hazardous-energy control.
| Attempted fix | Why it fails | Required decision |
|---|---|---|
| Press the emergency stop | An emergency stop commands a stop through the control system. Energy can remain in conductors, pressure vessels, cylinders, elevated loads, springs, hot surfaces, or rotating components. | Identify and operate every applicable energy-isolating device, then control stored energy. |
| Call the worker an operator |
OSHA 1910.147 distinguishes work by the activity and exposure, not merely by department or payroll classification. |
Classify the specific task: production use, setup, adjustment, inspection, cleaning, unjamming, tool change, modification, or repair. |
| Use guard removal as the only dividing line | Removing a guard is a strong warning that production safeguards no longer provide their intended protection, but hazardous exposure can also occur without guard removal. | Evaluate access to danger zones and exposure to unexpected energization, startup, or hazardous-energy release. |
| Rely on training alone | Knowledge cannot physically interrupt a power source or restrain a load. This is energy, not logic. | Combine engineered isolation provisions, a documented energy-control procedure, and role-specific training. |
| Treat stopped motion as a safe state | Stationary mechanisms may restart, descend, rotate, heat, or move when trapped energy is released. | Verify isolation and stored-energy control at the point of work before access. |
Hazardous energy as the real boundary
The practical boundary appears when the intended production function gives way to work that exposes a person to unexpected energization, startup, or release of hazardous energy. Under the definitions quoted from OSHA 1910.147, normal production operations are use of a machine or equipment to perform its intended production function. Servicing and maintenance include constructing, installing, setting up, adjusting, inspecting, modifying, maintaining, lubricating, cleaning, unjamming, making adjustments, and changing tools when the employee may be exposed to those energy hazards.
The same job can cross the boundary during one shift. Running guarded equipment may be normal production. Opening an access point to clear a jam may become servicing because the safeguard has been defeated and hazardous motion can return. The classification follows the step being performed and the resulting exposure.
| Quantity or condition | Decision limit | Where to read or determine it |
|---|---|---|
| Electrical energy | Any source capable of hazardous shock, arc, heating, or motion at the work point | Machine drawings, disconnect identification, drive and power-supply indicators, and an appropriate test instrument |
| Fluid pressure | Pressure or trapped volume capable of moving an actuator or ejecting material | Pressure gauges, schematics, accumulator data, and a verified bleed or restraint point |
| Gravitational energy | An elevated or unbalanced component capable of descending or shifting | Machine configuration, load path, counterbalance arrangement, and blocking points |
| Elastic energy | A compressed, stretched, or torsion-loaded element capable of movement | Mechanical drawings and direct inspection of springs, belts, clamps, and tensioned mechanisms |
| Thermal energy | A surface, fluid, or material temperature capable of injury or pressure generation | Temperature indication, process instrumentation, and a suitable measurement at the exposure point |
| Inertial energy | Motion that continues after the stop command | Direct observation and confirmation that all rotating or translating parts have stopped |
Task-based regulatory classification
A written boundary should use observable task conditions. It should not depend on an informal understanding of what operators and maintenance technicians “normally” do. Apply the following decision path to each task:
- State the intended production function and the guarded operating state. Record the installed guards, safety switches, operating controls, and expected material flow.
- Break the job into individual steps. Include setup, adjustment, inspection, cleaning, lubrication, unjamming, tool changes, troubleshooting, and repair rather than hiding them under a broad job title.
- For each step, identify every energy source and the mechanism by which energy could reach the worker.
- Determine whether the step requires removing a guard, bypassing a safety switch, entering a danger zone, or placing any body part where hazardous motion or energy could occur.
- Ask whether unexpected energization, startup, or release of stored energy could expose the employee. If yes, classify the step as servicing or maintenance for energy-control purposes.
- Assign the role permitted to perform the step and the required energy-control procedure. A production employee who performs a servicing task needs the authorization and training attached to that task.
- Document any step that can be performed without exposure and state the conditions that keep it within normal production. If those conditions change, stop and reclassify the work.
Cost accounting categories such as direct labor, indirect labor, operator, setup, and maintenance may help manage the business, but they do not determine hazardous-energy exposure.
Designer and employer responsibilities
The equipment designer should provide practical means to guard hazards during intended production and isolate energy during servicing. That includes locating isolation points where workers can use them, identifying energy sources, accounting for stored or reaccumulating energy, and supplying instructions that describe safe shutdown and servicing conditions. A design review should compare the protection with the hazards and with the state of the art for comparable machinery at the time of manufacture.
The employer controls how the installed machine is used. The employer establishes the energy-control program, assigns authorized and affected employees, provides task-specific procedures, trains employees, and verifies that guards and energy controls are used. A responsibility matrix should make this split explicit rather than attempting to transfer all responsibility to either the equipment manufacturer or the worker.
| Function | Designer or manufacturer deliverable | Employer or machine owner action |
|---|---|---|
| Production guarding | Guards and safety functions suited to intended operation | Keep protection installed, inspect it, and control unauthorized defeat |
| Energy isolation | Accessible isolation provisions and energy-source information | Create machine-specific lockout/tagout procedures and provide locks, tags, restraints, and test equipment |
| Stored energy | Identify discharge, blocking, restraint, or stabilization needs | Apply and verify those controls before work begins |
| Training information | Operating and servicing instructions, limitations, and residual-hazard information | Train each employee according to assigned duties and observed exposure |
| Changes in use | Define intended use and design limits | Review modifications, new tasks, and production changes before authorizing work |
Energy-control procedure for servicing work
An emergency stop may be used to halt immediate motion, but it is not the final protective measure for access to hazardous energy. Build the machine-specific procedure around physical isolation and verification:
- Identify the task, affected area, energy sources, stored-energy locations, isolation devices, and workers who may be affected.
- Notify affected employees that the machine will be shut down and placed under energy control.
- Stop the machine through its normal stopping sequence when conditions permit.
- Operate the identified energy-isolating devices. Apply locks and tags according to the employer’s energy-control program.
- Release, disconnect, restrain, block, or otherwise control stored energy. Address elevated machine members, accumulators, trapped pressure, capacitors, springs, thermal sources, and rotating inertia applicable to the machine.
- Check for energy that can reaccumulate. Continue restraint, bleeding, monitoring, or repeated verification when the mechanism can restore a hazardous state.
- Verify isolation before work. Use the machine controls as prescribed by the procedure and test measurable energy with suitable instruments. Return controls to the required state after the test.
- Perform the servicing task within the defined scope. A change in task or exposure triggers another energy review.
- Before restoration, inspect the machine, account for people and tools, restore guards, remove energy controls under the employer’s procedure, and notify affected employees.
Role-specific training and authorization
OSHA 1910.147(c)(7)(i)(A) requires each authorized employee to receive training in recognizing applicable hazardous-energy sources, the type and magnitude of energy available, and the methods and means needed for isolation and control. Authorization belongs to the employee applying energy control for servicing, not automatically to everyone carrying a maintenance title.
OSHA 1910.147(c)(7)(i)(B) requires affected employees to be instructed in the purpose and use of the energy-control procedure. These employees operate or use equipment on which servicing occurs, or work where the procedure is used, without necessarily applying the isolation themselves.
OSHA 1910.147(c)(7)(i)(C) requires other employees who work in an area where energy-control procedures may be used to receive instruction about the procedure and the prohibition against attempting to restart or reenergize locked- or tagged-out equipment. Training records should map each person to authorized, affected, or other-employee duties and to the actual tasks performed.
Verification and boundary records
Verification must prove that the hazardous state has been controlled at the exposure point. A pressed stop button, illuminated indicator, silent motor, or closed valve handle is not proof by itself. Test the condition through the isolation procedure, appropriate measurements, and direct confirmation of mechanical restraint.
Record the normal guarded state, foreseeable servicing tasks, isolation points, stored-energy controls, verification method, permitted role, and required training. Investigate any event involving guard removal, safety-switch bypass, or entry into a danger zone by reconstructing the task step and energy state—not by debating whether the injured person was called an operator or a maintenance worker.
Frequently asked questions
What happens if an operator removes a guard to clear a jam?
If that step exposes the operator to unexpected energization, startup, or hazardous-energy release, classify the step as servicing or maintenance under OSHA 1910.147. Apply the energy-control procedure and require the training and authorization assigned to the task.
What happens if the emergency stop is pressed but stored energy remains?
The machine is stopped but not proven safe for servicing. Isolate each applicable source, dissipate or restrain stored energy, address reaccumulation, and verify the condition before access.
What happens if the operation-maintenance boundary remains disputed?
Stop work when the task, isolation points, stored-energy controls, or worker authorization cannot be defined and verified. Escalate the machine-specific design question through the manufacturer’s official support channel and the regulatory interpretation through the appropriate official OSHA channel before restarting the task.