Lockout/Tagout for Elevator Systems

Why Lockout/Tagout Matters in Elevator Work

Elevator systems store energy in several forms at the same time: electrical power in controllers and motors, hydraulic pressure in cylinders and lines, and gravitational potential energy in the car and counterweight. A car that appears stationary can move if a brake releases unexpectedly. A hydraulic cylinder can slowly drift downward under load. A capacitor bank in a drive controller can hold a lethal charge after the main disconnect is opened. OSHA 29 CFR 1910.147, the Control of Hazardous Energy standard (commonly called the Lockout/Tagout or LOTO standard), requires employers to have a written energy-control program and machine-specific written procedures for every piece of equipment that presents this kind of risk. As a pre-apprentice, you must be able to follow and eventually draft those procedures correctly every time—with zero skipped steps.

The Three Roles in a LOTO Procedure

Authorized employee – the person who actually applies the lock. This worker has been trained to recognize hazardous energy sources and knows the specific isolation steps for the machine.

Affected employee – anyone who operates the machine normally or works in an area where LOTO is being performed. Affected employees must be told that LOTO is in effect and must never attempt to restart the machine.

Auditor (periodic audit role) – OSHA 1910.147 requires that the energy-control program be reviewed at least annually. An auditor observes the authorized employee performing the procedure to verify it is being followed correctly and that the written procedure remains accurate.

In a typical elevator crew, these roles shift. You need to be competent in all three.

Energy Sources in Elevator Systems

Electrical Energy

Traction elevators use three-phase power for the drive motor and single-phase or low-voltage circuits for the controller logic, lighting, and communications. The main line disconnect in the machine room is the primary isolation point. However, some controllers have separate feeds for lighting circuits or secondary panels—each must be identified in the written procedure and individually locked out. Always assume additional sources exist until you have verified with a diagram.

Hydraulic Pressure

Hydraulic elevators use a power unit—motor, pump, valve manifold, and fluid reservoir—to push a piston that raises the car. When the pump stops, pressure remains in the cylinder and hydraulic lines. Isolation requires: closing and locking the manual shut-off valve, then slowly opening the bleed valve on the manifold until the pressure gauge reads zero. Never assume the gauge itself is functioning; compare it against the expected resting value and look for physical signs such as cylinder drift before proceeding.

Gravitational (Stored Mechanical) Energy

The elevator car and counterweight each represent potential energy based on their mass and height. Even with power removed, a car can descend if the brake is released or if a mechanical failure occurs. Car safeties (the mechanical gripping devices on the guide rails) or certified mechanical stops (blocking devices placed under the car) must be engaged and verified before anyone works under, over, or inside the car. The counterweight creates a balancing hazard: if the car is at the bottom of the hoistway, the counterweight is near the top and vice versa. Both positions must be assessed.

The Correct Sequence for Traction Elevator LOTO

1. Notify all affected employees that the elevator is being taken out of service.

2. Review the machine-specific written procedure before touching anything.

3. Position the car at a landing where mechanical stops or safeties can be engaged safely.

4. Engage car safeties or mechanical stops and verify they are locked in position.

5. Open the main line disconnect in the machine room and apply your personal padlock and an identifying tag.

6. Lock out all secondary electrical sources (lighting panels, secondary feeds) identified in the procedure.

7. Attempt to operate the normal control (press call button or jog control) to verify the circuit will not energize—this is a no-voltage operation test, not a replacement for instrument testing.

8. Use a non-contact voltage tester or clamp meter on each conductor at the controller terminal strip to verify absence of voltage. Test the tester on a known live source before and after to confirm it is functioning.

9. Sign and date the lockout log.

For hydraulic units, insert step 3a: close and lock the manual shut-off valve on the hydraulic line, then open the bleed valve and confirm gauge reads zero pressure before continuing.

Verification: Never Skip the Test

The most dangerous moment in any LOTO procedure is assuming energy has been removed without confirming it with instruments. The test sequence is: test the tester → test the circuit → test the tester again. If the tester fails either confirmation test, replace it before proceeding. Use a non-contact voltage tester for a quick initial check, then confirm with a clamp meter or multimeter across each phase at the controller input terminals.

Re-Energization

Re-energization must follow the documented sequence in reverse:

1. Ensure all tools and materials are removed from the work area.

2. Confirm all personnel are clear of the hazard zone.

3. Remove mechanical stops or release car safeties.

4. Remove each personal lock in reverse order of application—each person removes only their own lock.

5. Remove lockout tags.

6. Close the disconnect(s) and restore power.

7. Notify affected employees that the elevator is back in service.

Documentation and the Written Procedure

OSHA requires a machine-specific written procedure when a machine has more than one energy source or when the magnitude of hazardous energy is not obvious. Elevator systems always meet this threshold. Your written procedure must list every energy type, the location and type of each isolation point, the specific steps to achieve and verify zero energy, and re-energization steps. During the audit activity, the auditor checks each element against the procedure template and the actual steps performed. Discrepancies must be corrected before the procedure is approved for use.