5.1 The written procedure is part of the tool kit

1 The four elements a procedure must contain

1910.147(c)(4)(ii): "The procedures shall clearly and specifically outline the scope, purpose, authorization, rules, and techniques to be utilized for the control of hazardous energy, and the means to enforce compliance including, but not limited to, the following:"

1. 1
   (A) A specific statement of the intended use of the procedure. Which machine, and which work on it. A procedure that says "all presses" tells you nothing about the one in front of you.
2. 2
   (B) Specific procedural steps for shutting down, isolating, blocking and securing machines or equipment to control hazardous energy. Named devices, in order, including the blocking.
3. 3
   (C) Specific procedural steps for the placement, removal and transfer of lockout devices or tagout devices, and the responsibility for them. Who applies, who removes, and what happens at shift change.
4. 4
   (D) Specific requirements for testing a machine or equipment to determine and verify the effectiveness of lockout devices, tagout devices, and other energy control measures. How you prove it is dead.

Element (D) is the one that separates a real procedure from a template. A document that lists breakers to open and stops there has told you how to perform steps 3 and 4 of paragraph (d) and left steps 5 and 6 — stored energy and verification — to your judgment. Those are the two steps that kill people.

2 The generic procedure problem

Appendix A to 1910.147 contains a "Typical Minimal Lockout Procedure," and its introduction is honest about what it is: "The following simple lockout procedure is provided to assist employers in developing their procedures so they meet the requirements of this standard... For more complex systems, more comprehensive procedures may need to be developed, documented and utilized."

What makes the appendix useful is the blanks it leaves. After step 2 it says "Type(s) and magnitude(s) of energy, its hazards and the methods to control the energy." After step 3, "Type(s) and location(s) of machine or equipment operating controls." After step 4, "Type(s) and location(s) of energy isolating devices." After step 6, "Type(s) of stored energy — methods to dissipate or restrain." After step 7, "Method of verifying the isolation of the equipment."

Those five blanks are the machine-specific content. A "procedure" that is the appendix with the blanks unfilled is the appendix, not a procedure — and that is exactly what a great many plant binders contain. There is a full article on this site about why generic procedures fail an inspection; the short version is that everything an inspector wants to see is in those five blanks.

3 Where the equipment information actually lives

A procedure is written from documents, and in a plant covered by 1910.119 those documents are required to exist. (d) requires process safety information — chemical hazards, technology of the process, and equipment information. (f)(1) requires written operating procedures with steps for initial startup, normal operations, temporary operations, emergency shutdown, emergency operations, normal shutdown, and "startup following a turnaround, or after an emergency shutdown"; operating limits with the consequences of deviation and the steps to correct it; safety and health considerations; and safety systems and their functions.

Two clauses in (f) belong to maintenance by name. (f)(2): "Operating procedures shall be readily accessible to employees who work in or maintain a process." And (f)(4): "The employer shall develop and implement safe work practices to provide for the control of hazards during operations such as lockout/tagout; confined space entry; opening process equipment or piping; and control over entrance into a facility by maintenance, contractor, laboratory, or other support personnel. These safe work practices shall apply to employees and contractor employees."

"Opening process equipment or piping" is in that list as its own named practice. It is one of the highest-consequence maintenance tasks there is, and where PSM applies there is supposed to be a written practice for it — not a habit.

Where PSM does not apply, the equivalent documents are the manufacturer's manual, the electrical and P&ID drawings, the equipment nameplate and 1910.303(b)(2): "Listed or labeled equipment shall be installed and used in accordance with any instructions included in the listing or labeling." That last one turns the manufacturer's instructions into a requirement rather than a suggestion.

4 Mechanical integrity: a written program for maintenance itself

1910.119(j) is the only place in 29 CFR 1910 that describes a maintenance program as a program. It applies to six categories of process equipment listed in (j)(1): pressure vessels and storage tanks; piping systems including components such as valves; relief and vent systems and devices; emergency shutdown systems; controls including monitoring devices and sensors, alarms and interlocks; and pumps.

Two of these are worth carrying into any plant, PSM or not. (j)(4)(iii)'s phrase "more frequently if determined to be necessary by prior operating experience" is the regulatory version of what a good planner already does: a bearing that failed twice gets inspected more often, not on the same annual cycle. And (j)(6)(iii) — spare parts suitable for the application — is the sentence behind every failure caused by a substituted fastener, a wrong-class valve or a bearing from the nearest supplier.

5 Reviewing and updating: the annual certification

1910.119(f)(3) sets a review obligation that most maintenance departments have never been asked about: "The operating procedures shall be reviewed as often as necessary to assure that they reflect current operating practice, including changes that result from changes in process chemicals, technology, and equipment, and changes to facilities. The employer shall certify annually that these operating procedures are current and accurate."

1910.147 has no annual certification of procedures, but it has something functionally similar in (c)(6): the annual periodic inspection of the energy control procedure, whose purpose is "to ensure that the procedure and the requirements of this standard are being followed," conducted by an authorized employee other than the ones using the procedure being inspected, and "conducted to correct any deviations or inadequacies identified." Chapter 2 of this part covers what it produces.

Between them, those two paragraphs describe the honest life cycle of a procedure: it is written from documents, tested against the machine, used, found wanting, and corrected. A procedure that has never changed since it was written is either describing a machine nobody has touched or a review nobody has done.

6 Writing one that a stranger can use at 2 a.m.

The test of a procedure is not whether the person who wrote it can follow it. It is whether a competent technician who has never seen this machine can follow it alone at two in the morning. Six things make that possible, and all six are things the standard already asks for.

• Name the machine and the work. Asset number, location and the tasks the procedure covers, per (c)(4)(ii)(A).
• List every energy with its magnitude. Not "electrical" but "480 V, 3-phase, MCC-4 bucket 7" — and not "hydraulic" but "2,500 psi, HPU-2, accumulator on the head end."
• Name each device with its physical location. A device the reader cannot find is a step they will skip.
• Say what has to be blocked, with what, and where the block lives. This is the half of (c)(4)(ii)(B) most procedures omit.
• Write the verification as an action with a result. "Test L1-L2, L2-L3, L1-L3 at the machine disconnect load side with a rated instrument; expect 0 V" is a verification. "Confirm deenergized" is not.
• Say who removes the devices and what happens at shift change. Per (c)(4)(ii)(C), and see Chapter 3 of this part.

There is a free lockout/tagout procedure generator on this site that produces a machine-specific document along these lines, and a hot work permit generator that follows 1910.252(a) and 1910.119(k). Neither of them knows your machine — the five blanks from Appendix A are still yours to fill.