A quiet machine can still hurt someone

Picture a packaging line late on a Friday. A carton jams at the transfer point, production is waiting, and a mechanic is called over to clear it. The operator has pressed stop. The conveyor is silent, the display has gone dark, and nobody expects anything to move. What isn't visible from the aisle is the air held in a cylinder behind the guard. When the obstruction is removed, that pressure could move a component into the mechanic's hands. It's an illustrative situation, but the decision it presents is familiar in manufacturing, food processing, maintenance shops and utilities. A worker sees a machine that appears stopped and makes the mental leap to safe. The gap between those two conditions is where hazardous energy injuries occur.

A proper lockout/tagout (LOTO) refresher needs to challenge that assumption. Electricity is only part of the picture. Hydraulic pressure, compressed air, heat, springs, raised equipment and materials moving under gravity can remain dangerous after the main supply is shut off. As the Canadian Centre for Occupational Health and Safety (CCOHS) explains, hazardous energy control addresses unintended start-up, unexpected movement and the release of stored energy, particularly when workers must remove or bypass normal safeguards to service equipment. [1]

The point deserves emphasis because many workers already know the rules. They're less certain when the job changes, the procedure is vague or production needs the machine back. That's when a refresher should earn its place.

The word "off" creates more confusion than it should

A stop button tells a machine to stop operating. It doesn't necessarily prevent energy from reaching the equipment again. Neither does a touchscreen command, an emergency stop or a selector switch. Those controls may be essential for normal operation and emergency response, but CCOHS distinguishes them from energy-isolating devices such as suitable disconnects, circuit breakers and line valves. [2] That distinction becomes harder on modern lines. One disconnect may shut down a drive while a second supply serves a heater or control circuit. A programmable controller may initiate a sequence after a fault clears. An adjacent piece of equipment may share mechanical connections with the section being serviced. If the worker isolates only the source they can see, the remaining exposure doesn't disappear because a lock is hanging on the panel.

Consider what happens during a hurried shutdown. The mechanic asks which disconnect belongs to the conveyor. Someone points to a labelled switch, but nobody can say whether it also isolates the pneumatic actuator or the gravity-fed transfer. That's a reason to stop and resolve the isolation boundary, not a reason to proceed carefully. The worker needs an equipment-specific procedure that identifies every relevant energy source and the approved means of controlling it.

At its best, refresher training sends people back to the machine. Have them find the actual isolation points, compare them with the procedure and explain what could still move after shutdown. An unclear label or outdated drawing discovered during that exercise is a useful finding. Discovering it during a jam-clearing injury investigation is too late.

Stored energy is where a familiar procedure becomes dangerous

A hydraulic press can move after its motor has been disconnected if pressure remains trapped or a raised component isn't physically supported. A large spring may hold enough tension to release suddenly. Steam lines retain heat and pressure; electrical equipment can retain charge in capacitors. A suspended load can fall without anyone restarting a motor.

The controls therefore depend on the energy, the equipment and the work. Stored pressure may need to be relieved through an approved method, while gravity-related hazards may require engineered blocking or restraint. Electrical testing and discharge require the correct procedures, instruments and qualified people. Workers must not improvise these steps from a general training slide or assume that closing a valve is the same as removing everything downstream that could cause harm. CCOHS makes the same distinction between isolating the primary supply and controlling the energy still present in the system. [1][2]

There is a practical consequence for how employers write procedures. The instruction "isolate the machine" is too broad if it leaves the worker guessing what to do with a suspended assembly or a charged component. A useful procedure names the source, the hazard it creates, the approved control and how workers will confirm that control has worked.

Some energy can be dissipated. Other energy has to be securely restrained. Treating both as a generic "zero energy" step invites shortcuts, particularly when a crew is working on equipment it knows well enough to become overconfident around.

Verification is the step that proves the protection

Lockout is often taught as a sequence: prepare, shut down, isolate, apply locks, control stored energy and verify. That sequence has value, but reciting it doesn't establish competence. The difficult part is knowing what verification means for a particular machine and whether the method itself introduces a hazard.

On one piece of equipment, an approved controlled start attempt may help demonstrate that a drive cannot operate. Elsewhere, verification may require confirming the absence of pressure, checking that a component cannot move or using an appropriate electrical testing procedure. Those aren't interchangeable tasks. The person doing the work has to understand the energy sources and use the site-approved method that addresses each one. [2]

Even here, the system needs to be practical. If equipment has no usable test point or an isolation point cannot be reached safely, the employer has a design problem that another lecture will not solve.

British Columbia makes this obligation explicit. Section 10.6 of WorkSafeBC's Occupational Health and Safety Regulation requires effective means of verifying lockout and requires workers to verify that all energy sources have been effectively locked out before work begins. [3] The exact legal wording elsewhere may differ, but the operating question remains the same: what evidence does the worker have, at the point of exposure, that the machinery cannot release hazardous energy?

This is why a classroom quiz should never be the entire refresher for an authorized worker. Put the actual procedure in their hands. Ask them to show the approved isolation and verification method, describe the sources that remain after shutdown and recognize the point at which work must not proceed. If they can't do that confidently, the issue is training and control readiness, not an unsuccessful test score to be filed away.

Group lockout is usually tested by what happens after the first shift

A solo maintenance task is comparatively straightforward to coordinate. A shutdown involving electricians, millwrights, sanitation workers and contractors is another matter. People arrive at different times, work on different sections and leave before the equipment is ready to restart. Someone may be called away, the maintenance window may run late, or an incoming crew may assume the outgoing crew has dealt with the handover. This is where personal protection can become blurred by shared responsibility. One person's lock cannot simply stand in for everyone else's protection when the applicable procedure requires individual personal locking. Workers must know what group arrangement applies, which equipment it covers, how they attach their own protection and how the system remains secure when personnel change.

British Columbia provides a specific example of why local requirements matter. Section 10.9 sets out a group lockout procedure involving two qualified workers, independent lockout of energy-isolating devices, secured keys, a signed and posted checklist, and personal locks applied by workers participating in the work. The regulation also deals with transfer of lockout control during shift changes and controlled removal of locks. [3] Those are not optional details for a BC worksite using that procedure, and the BC model should not be presented as a universal Canadian rule.

The best group-lockout refresher works through awkward situations instead of an ideal diagram. What happens when a contractor arrives after isolation is complete? What if a worker leaves without removing a personal lock? What if the job crosses shifts, the isolation boundary changes or production wants to test one section before other work is finished? Those questions expose whether the written process is understood under real operating conditions.

Production pressure is often the missing hazard assessment

Jam clearing, adjustment, troubleshooting and set-up are the moments when people are most likely to challenge the normal process. A line has stopped, customers are waiting, and complete isolation may appear to make a diagnostic task impossible. Workers who have repaired the equipment dozens of times can become confident that a short intervention is harmless.

That confidence isn't a substitute for control. Holding an interlock, reaching past a guard, relying on jog mode or asking someone to watch the controls can put a worker inside the hazard zone while energy remains available. Calling the job "just a quick adjustment" doesn't change what the machine can do.

Sometimes the task genuinely cannot be completed with every energy source isolated. That is a design and risk-assessment question for qualified people, not an invitation to invent a workaround in the moment.

CSA Z460:20, reaffirmed in 2025, recognizes lockout as the primary hazardous-energy control method and addresses other methods for certain production-integral tasks or situations where full lockout prevents completion of the work. Those other methods depend on formal risk assessment and effective protective measures. [5] The standard doesn't give workers permission to improvise exceptions, and its application must be considered alongside the legislation governing the work.

Where an alternative is permitted, the employer needs a documented, task-specific approach developed by competent people, with safeguards and authorization appropriate to the risk. In British Columbia, Part 10 contains provisions addressing alternative procedures and energized work. [3] Supervisors should be especially alert when an exception has become routine. If workers regularly say, "We always do it this way," that's a prompt to inspect the procedure, not an assurance that the method is safe.

Supervisors have to know what actually happens during maintenance

A safety department may have a polished hazardous-energy program while the shop floor works from unofficial habits. Procedures get photocopied after equipment modifications. An isolation point is labelled for a machine that was reconfigured two years ago. Personal locks are available in the cabinet, but the night shift knows where to find only one hasp. These are the ordinary conditions that determine whether a control system holds up when a breakdown occurs.

Supervisors can identify them only by going to the work. Observe a representative task, ask the worker to walk through the equipment-specific procedure and check whether the listed isolation points still match the machine. Look closely at jam clearing, sanitation, contractor maintenance and changeovers, because those tasks are easily treated as outside the "real" maintenance program even when hazardous energy is present.

There is also an important distinction between workers who carry out energy isolation and those affected by it. People performing the work need training and demonstrated competence for their authorized tasks. Operators and others working nearby need to understand what the lockout means, why they must not disturb the system and how to communicate when conditions change. A contractor can't be left to infer the host employer's expectations from a sign on a cabinet.

The supervisor's measure of success should be simple enough to observe. Did the team establish the correct isolation boundary? Were stored hazards controlled? Could everyone explain their protection? Was verification completed before anyone entered the danger area? Signed attendance records matter for documentation, but they cannot answer those questions on their own.

Refresher training should respond to change, not merely the calendar

Many employers schedule LOTO training annually because it's administratively convenient. Periodic instruction can reinforce knowledge, but a single national annual retraining rule should not be assumed. Applicable laws, industry requirements and the employer's program determine the obligations. More importantly, competence can become outdated well before the next calendar date.

A conveyor is modified. A new robot is connected to an existing line. A contractor takes over maintenance. A near miss reveals that pressure remains in a section of piping after the documented isolation steps. Each change is a reason to revisit the relevant procedure and check whether workers can still carry it out safely. So are repeated deviations, unclear isolation labels and observed uncertainty during field verification.

The refresher itself can be shorter than a full initial course if the fundamentals are already established. What it cannot be is generic. Give authorized workers scenarios drawn from equipment they service, observe a practical demonstration, correct the gaps and retain a record of the result. Use different instruction for affected workers who need to recognize the system and respect the protection it provides.

That approach also gives the employer better evidence of due diligence. Training records show who participated; field assessments show whether the instruction transferred to work. The second is what matters when a supervisor has to decide whether a worker can perform a task independently.

Canadian compliance needs a local check

The underlying prevention principles travel across Canada, but the legal requirements do not always use identical language. British Columbia's Part 10 addresses de-energization, verification, personal and group lockout, and certain alternatives. Ontario's Regulation 851, for industrial establishments, addresses hazardous machine movement and precautions against unexpected starting in sections 75 and 76. [3][4]

CSA Z460 is an important technical reference for program design and risk-assessed methods. It is not, by itself, proof that every provision has the same legal status in every province, territory or industry. Employers must review their applicable law, any incorporated standards and the equipment-specific hazards before approving procedures or deciding what training will satisfy their obligations.

For a company with operations in several provinces, that calls for one coherent control philosophy supported by local legal checks, not a pile of unrelated site practices. Workers should encounter consistent expectations about identifying energy, protecting people and verifying isolation, while site procedures address the requirements that truly differ.

The metrics leadership should be asking for

Training completion rates are easy to report, which is precisely why they can dominate safety dashboards. They tell senior leaders how many people attended. They don't show whether a press has an accurate procedure, whether a mechanic verified stored pressure or whether a shift handover preserved personal protection.

A stronger monthly review would ask which high-risk machines still lack verified, current procedures; whether supervisors have found mismatches between procedures and equipment; and how quickly those deficiencies are corrected. It should also examine lockout-related near misses, contractor interface problems and observed deviations. If a crew repeatedly bypasses a safeguard to clear jams, leadership should want to know why the task is difficult to do safely and who is accountable for redesigning it.

Not every problem requires a new training module. Some require engineering changes, accessible isolation points, better maintenance planning or a realistic shutdown window. Sending workers back to a classroom while leaving those barriers untouched is unlikely to change their decisions when the next machine jams.

What the next refresher should change

The most useful LOTO refresher ends with an uncomfortable but practical question: if the equipment failed right now, would the people called to repair it have everything they need to isolate and verify it without improvising? If the answer is uncertain, the employer has found its next piece of prevention work.

Give workers procedures that match the machinery. Make isolation points accessible and unambiguous. Practise group arrangements and handovers under conditions that resemble a real shutdown. Above all, verify competence where the work is performed, with supervisors prepared to stop the job when the energy-control method is unclear.

A padlock is visible proof that a device has been secured. The more important proof is that the person relying on it understands every hazardous energy source, has controlled the exposure and can demonstrate that the equipment is safe for the work ahead.