LOTO for Battery Energy Storage Systems

LOTO for battery energy storage systems showing BESS equipment, DC isolation, lockout/tagout devices, and stored-energy safety controls.

Battery energy storage systems (BESS) present hazardous-energy control challenges that differ materially from conventional AC electrical equipment. Opening an AC breaker, stopping an inverter, or commanding a shutdown through a building management or battery management system does not establish a zero-energy condition. Cells, modules, and racks retain electrochemical energy and can maintain hazardous DC voltage regardless of the status of upstream AC circuits or software controls.

This article applies energy-control principles specifically to BESS servicing and maintenance. It complements the Complete Guide to Lockout/Tagout for Electrical Systems and the 29 CFR 1910.147: OSHA’s Control of Hazardous Energy (Lockout/Tagout) Standard. It does not replace them, nor does it substitute for employer-developed procedures, manufacturer documentation, or qualified-person evaluation of specific systems.

Important framing: This article is for general educational purposes. It does not constitute legal advice, a compliance determination, or a field procedure for any specific system. BESS designs vary significantly. Always follow the system’s manufacturer documentation, your employer’s energy-control procedures, applicable OSHA standards, and the judgment of qualified personnel.

Why BESS LOTO Is Different

Conventional electrical LOTO on AC equipment typically involves isolating one or a small number of energy-isolating devices, releasing residual charge, and verifying absence of voltage. The energy source — the utility supply — is external and can be physically interrupted at the service entrance or distribution point.

A BESS is itself an energy source. It stores electrochemical energy in cells that cannot be “turned off” in the way an AC supply can be interrupted. Key differences include:

  • The battery cannot be de-energized by disconnection from external supply. Isolation of AC grid, inverter, or PCS circuits removes the ability to charge or discharge through those circuits but does not remove the energy stored in the cells.
  • Hazardous DC voltage persists. Depending on system architecture, battery strings can operate at hundreds of volts DC. This voltage exists at terminals, busbars, and interconnecting conductors even when the system appears inactive.
  • Multiple independent energy sources may be present simultaneously. A single BESS installation may include utility AC, alternate AC feeds, PV or generator inputs, multiple battery strings or racks, control/auxiliary power, capacitors, and DC-link energy — each requiring its own evaluation.
  • Software-controlled states are not energy isolation. A BMS or EMS indicating “off,” “standby,” or “shutdown” is a control state, not a verified isolated condition.
  • Bidirectional energy flow. BESS systems charge and discharge; energy can flow in both directions through DC buses, inverters, and interconnections. Isolation must account for both directions and all connected sources.

Understanding Energy Inside a BESS

A typical BESS architecture progresses from electrochemical cell to grid interface, though designs vary significantly:

  • Cells — the basic electrochemical units. Individual cell voltage is relatively low, but cells are connected in series and parallel to achieve system voltage and capacity.
  • Modules — groups of cells assembled into a mechanical and electrical unit with integrated monitoring and sometimes protection devices.
  • Racks or strings — groups of modules connected in series to achieve string voltage. A rack or string may operate at hundreds of volts DC.
  • DC bus — the common DC conductor to which strings connect and from which the power conversion system draws energy.
  • Power Conversion System (PCS) / Inverter — converts DC from the battery to AC for grid or facility use, and AC to DC for charging. May contain DC-link capacitors that retain charge after shutdown.
  • Grid interface / transformer — connects the AC output to the utility or facility distribution system.

Each level of this hierarchy may have its own disconnects, breakers, contactors, or fuses. The presence of a disconnect at one level does not mean energy is absent at other levels. Isolation must be verified at the point of work, not assumed from the status of upstream or downstream devices.

Identify Every Energy Source

Before defining an isolation boundary, all energy sources that could present hazardous exposure at the work location must be identified. Depending on the specific system and task, these may include:

  • Utility or grid AC supply
  • Alternate AC feeds (redundant utility service, transfer switches, generator inputs)
  • Battery strings and racks (DC, potentially multiple independent strings)
  • DC bus conductors and associated hardware
  • PCS/inverter DC-link capacitors
  • Interconnected PV generation sources (which cannot be de-energized while illuminated)
  • Generator or other generation inputs
  • Auxiliary and control power supplies (may be fed from separate circuits or UPS systems)
  • Communication and instrumentation circuits where applicable voltage levels create hazard

Not every system contains every source listed. Source identification must be based on the actual system one-line diagrams, manufacturer documentation, as-built drawings, and the specific task being performed — not a generic checklist.

Backfeed paths deserve particular attention. Energy can reach a work location from a source that is not the obvious primary supply. Interconnected equipment, parallel strings, regenerative paths through inverters, and PV arrays that cannot be switched off are common backfeed sources in BESS installations.

Define the Isolation Boundary

The isolation boundary is the set of energy-isolating devices that, when placed in their safe position and locked or tagged, will prevent hazardous energy from reaching the work location. Defining the boundary correctly requires:

  • Understanding the system architecture from current one-line diagrams and manufacturer documentation
  • Identifying every energy source that can deliver energy to the work location — including backfeed paths
  • Confirming which devices are capable of serving as energy-isolating devices (see BMS, Remote Controls, Contactors, and Disconnects below)
  • Determining whether the task requires isolation of the entire system, a string, a rack, a module, or a specific component

The isolation boundary for replacing a rack-level fuse is different from the boundary for working on the DC bus or the PCS. A single isolation boundary does not fit all BESS tasks. Employer procedures, manufacturer maintenance manuals, and qualified-person evaluation determine the appropriate boundary for each task.

AC Isolation Does Not Mean Battery Isolation

This is among the most operationally critical points in BESS hazardous energy control.

Opening or locking out the AC disconnect between the PCS and the grid removes the ability to exchange energy with the utility through that path. It does not affect the energy stored in battery cells. The DC bus may remain at full string voltage. The PCS DC-link capacitors may retain hazardous charge. Battery contactors within racks may remain closed.

Similarly, an inverter shutdown command — whether issued from the HMI, BMS, EMS, or SCADA — places the inverter in a controlled stop state. It does not open physical isolation devices between the battery and the DC bus, and it does not discharge cells.

Workers who have been trained on conventional AC LOTO must explicitly understand this distinction when working on BESS. The intuition that “the breaker is open, so the equipment is safe” does not transfer to BESS DC circuits or battery terminals.

Battery DC and Stored Electrochemical Energy

Cells store energy electrochemically. This energy is present as long as the cells are charged, regardless of whether any external circuit is connected. There is no switch, contactor, or breaker that removes the energy from within a cell.

What isolation can do is sectionalize the system — interrupt the conductive path between the battery and the work location, reducing the accessible energy at the point of work. For example:

  • Opening a string disconnect isolates that string’s terminals from the DC bus, so energy from other strings cannot reach those terminals through the bus.
  • Opening rack-level disconnects or contactors may further reduce accessible energy at module or cell level, depending on system design.

However, even after sectionalization, the cells within the isolated section remain charged. Work on or near battery terminals, interconnecting conductors, or busbars within an isolated section may still involve exposure to stored electrochemical energy. The level of protection required — isolation, additional barriers, PPE, work practices — depends on the task, the accessible voltage and energy, the system design, and the employer’s and manufacturer’s procedures.

Never assume that a padlock on a disconnect has de-energized the cells behind it.

Multiple Sources, Backfeed, and Interconnections

A BESS installation is frequently interconnected with multiple energy sources and with other equipment. Common configurations include:

  • Multiple battery strings connected to a common DC bus (each string is an independent energy source capable of energizing the bus)
  • PV arrays connected to the DC bus or through dedicated inverters (PV cannot be de-energized during daylight)
  • Generator inputs providing AC that feeds through the PCS
  • Redundant utility feeds or automatic transfer schemes
  • Auxiliary and control power sourced independently from the main battery or utility

Energy control for work on shared components — the DC bus, the PCS, the AC switchgear — must address every source that can deliver energy to that component. Locking out the utility AC while leaving a PV array connected to the DC bus, or locking out one string while others remain connected to the bus, does not establish isolation for work on the shared conductor.

OSHA has noted in guidance that workers can be exposed to hazardous energy from nearby or interconnected equipment if all relevant sources are not controlled. The energy-control procedure must identify and address all such sources for the specific task.

BMS, Remote Controls, Contactors, and Disconnects

Understanding which devices constitute energy-isolating devices — and which do not — is essential for BESS LOTO.

Battery Management System (BMS) / Energy Management System (EMS) / SCADA: These are control systems. They monitor, command, and communicate. Software commands issued through a BMS, EMS, or SCADA — including remote shutdown, discharge inhibit, or contactor open commands — are control actions, not physical energy isolation. A software command can fail to execute, be overridden, or be reversed by another control input. BMS/EMS/SCADA states do not substitute for physical isolation and lockout.

E-stops and remote shutdown buttons: These initiate controlled shutdown sequences. They are not energy-isolating devices and do not substitute for LOTO.

Contactors: Contactors are electrically operated switching devices. They are controlled by the BMS or other control systems and can open or close in response to control signals. Whether a contactor constitutes an energy-isolating device depends on its design, rating, and the applicable standard and procedure. Many contactors are not designed or rated as energy-isolating devices for LOTO purposes and cannot be locked in the open position. Verify the specific device’s capabilities and the applicable procedure before relying on a contactor as an isolation point.

Disconnects and breakers: Manual disconnect switches and circuit breakers that can be physically operated and locked in the open position are more likely to qualify as energy-isolating devices, but this depends on their design, rating, fault-current interrupting capacity, and the applicable procedure and standard. Not all devices labeled “disconnect” are equivalent. Verify actual isolation function against manufacturer documentation and the employer’s procedure.

The governing principle: verify what a device actually does, not what its label implies.

Residual Energy and Reaccumulation

After physical isolation devices have been placed in the safe position, residual energy may remain in the isolated section and must be addressed before work begins.

DC-link capacitors in PCS/inverters can retain significant charge after inverter shutdown and after DC isolation. Manufacturers specify discharge times and procedures; these vary by equipment and must not be assumed or invented. Always consult the manufacturer’s documentation for the specific inverter or PCS being serviced.

Capacitive energy in cables and busbars may also be present, particularly in long DC cable runs.

Reaccumulation is a significant concern in BESS environments. If isolation is incomplete — for example, if a string contactor is relied upon for isolation but fails to hold open — battery energy can reappear at a work location. Where 29 CFR 1910.147 applies to the covered activity, 1910.147(d)(5)(ii) requires that if stored energy can reaccumulate to hazardous levels, verification of isolation must continue until the servicing or maintenance is complete or until the possibility of reaccumulation no longer exists. This is not a provision that applies to every BESS electrical task (see OSHA Regulatory Boundaries), but the underlying principle — that a one-time check at the start of a job is insufficient when energy can return — applies broadly to BESS work.

Never assign a fixed universal discharge wait time. Consult manufacturer documentation for the specific equipment.

Verification Before Work

Verification confirms that the isolation boundary has been established and that hazardous energy is absent at the point of work. It is a required step — not optional and not replaceable by visual inspection of lock position or BMS status.

Important limitations in BESS environments:

  • HMI and BMS displays show system states as reported by sensors and software. They do not independently verify physical isolation or absence of voltage at a specific work point.
  • Indicator lights and “off” status indications on equipment panels reflect control states, not verified electrical conditions.
  • Remote commands and software confirmations confirm that a command was sent and acknowledged; they do not confirm physical device position or absence of voltage.
  • Contactor status feedback confirms reported contactor state; it does not independently verify the absence of voltage at accessible conductors.

Absence-of-voltage testing at the point of work, using instruments appropriate for the voltage and circuit type, and following the applicable procedure, is the means by which isolation is verified. The specific instruments, categories, and sequences required depend on the system, the task, and the applicable employer and manufacturer procedures. This article does not specify test sequences or meter categories for any specific system.

Applying LOTO to BESS Servicing

The general sequence for applying hazardous energy control to BESS servicing follows the principles established in applicable OSHA standards and the employer’s energy-control program. The specific steps, isolation points, and verification requirements vary by system, task, and governing procedure. The following describes the required elements — it is not a field procedure.

  • Prepare: Review the system one-line diagrams, manufacturer documentation, and the applicable energy-control procedure for the specific task. Identify all energy sources. Notify affected employees.
  • Shut down: Follow the manufacturer’s and employer’s shutdown sequence for the specific system. Note that shutdown does not establish isolation.
  • Isolate: Operate all energy-isolating devices identified in the procedure to their safe (open/de-energized) position. This includes all sources identified for the specific task — AC feeds, DC disconnects, string disconnects, auxiliary power, and any others specified in the procedure.
  • Apply lockout/tagout devices: Apply personal lockout devices (or tagout devices where lockout is not feasible, subject to applicable requirements) to each energy-isolating device. For group work, apply group LOTO per the employer’s group procedure.
  • Control residual energy: Allow manufacturer-specified discharge times for capacitors and DC-link components. Follow the procedure for any other residual energy present.
  • Verify: Confirm absence of hazardous energy at the point of work using appropriate instruments and the applicable procedure. If reaccumulation is possible, maintain ongoing verification per the applicable standard and procedure.

For regulatory framework governing these steps, see 29 CFR 1910.147, the Complete Guide to LOTO for Electrical Systems, and the OSHA regulatory boundaries section below.

Group Work, Contractors, and Shift Changes

The complexities of BESS energy control are amplified in multi-person, multi-employer, or multi-shift scenarios.

Group LOTO: When multiple authorized employees work on a BESS simultaneously, group lockout procedures must provide each worker with protection equivalent to a personal lockout device. Under 29 CFR 1910.147(f)(3), where applicable, each authorized employee must affix their own personal device to a group lockout hasp. One group lock applied by one person does not protect other workers still in the hazard zone.

Contractors and outside personnel: When outside servicing personnel work on a BESS alongside or after on-site employees, both employers must inform each other of their respective energy-control procedures and ensure their employees understand and comply with the applicable restrictions. Under 1910.147(f)(2), where applicable, this is a bilateral obligation. For BESS commissioning, maintenance, or retrofit work involving equipment manufacturers, integrators, or specialty contractors, energy-control coordination must be explicit and documented.

Shift changes: BESS maintenance tasks that extend across shifts require procedures ensuring continuity of protection during personnel transitions. No authorized employee should be left unprotected due to a gap between outgoing and incoming personnel. The employer’s procedure governs the transfer method; no single method is mandated, but the transfer must be orderly and documented.

See 29 CFR 1910.147 for detail on group LOTO, contractor coordination, and shift-change requirements under that standard.

Returning the BESS to Service

Restoration of a BESS to service after maintenance requires the same disciplined approach as the initial lockout. Before lockout devices are removed and energy is reintroduced:

  • Verify that all work is complete and all tools, materials, and personnel are clear of the system.
  • Ensure all protective covers, barriers, and guards are replaced per the manufacturer’s requirements.
  • Notify all affected employees that the LOTO devices are about to be removed and the system reenergized.
  • Remove lockout devices in accordance with the employer’s procedure — only the employee who applied each device may remove it under normal circumstances. Employer-directed removal requires a documented procedure with specific required steps.
  • Follow the manufacturer’s and employer’s reenergization sequence for the specific system. Do not improvise startup sequences.
  • Confirm system status through appropriate monitoring before declaring the system restored to service.

Damaged or Abnormal Battery Systems

Standard LOTO procedures are developed for systems in normal operating condition. Batteries that have been damaged, overheated, exposed to fire or flood, subjected to mechanical impact, or are suspected of thermal runaway present hazards that are outside the scope of routine energy-control procedures.

Hazards associated with abnormal battery conditions may include:

  • Thermal runaway — uncontrolled exothermic reaction that can propagate through cells, modules, and racks
  • Off-gassing of toxic, flammable, or asphyxiating gases
  • Fire and explosion risk from released electrolyte or gas ignition
  • Stranded energy — energy that cannot be safely discharged through normal means because of internal cell damage or faulted circuits
  • Structural hazard from compromised enclosures or racking systems
  • Chemical hazard from electrolyte leakage

LOTO does not eliminate these hazards. A padlock on a disconnect does not arrest thermal runaway, neutralize off-gas, or remove stranded electrochemical energy from damaged cells.

Assessment and response to abnormal BESS conditions require qualified personnel, manufacturer emergency response guidance, applicable emergency response procedures, and coordination with the authority having jurisdiction. Do not attempt to apply standard LOTO procedures to a system exhibiting signs of thermal runaway, fire damage, flooding, or severe mechanical damage without qualified assessment of the specific situation.

For broader electrical emergency response context, see the Complete Guide to Energized Electrical Work.

Automatic and Remote Operation

Modern BESS systems are designed for remote and automatic operation — automatic charge/discharge scheduling, remote shutdown, demand response, frequency regulation, and similar functions. These capabilities create energy-control hazards that must be addressed in the energy-control plan.

A BESS configured for automatic operation can receive a start, charge, or discharge command from a remote EMS or utility dispatch system while maintenance personnel are working on it. Remote commands can originate from utility markets, building automation systems, or cloud-based energy management platforms — potentially from locations outside the facility where maintenance is occurring.

The energy-control procedure for BESS maintenance must address how automatic and remote operation pathways are disabled and controlled for the duration of the maintenance activity. Software inhibits and remote lockout commands are control measures; they must be evaluated against the applicable standard and procedure to determine whether they constitute adequate isolation or whether physical isolation of communication and control pathways is also required.

OSHA 1910.147 / 1910.333 / 1910.269 Boundaries

Determining which OSHA standard governs a specific BESS task requires analysis of the installation, the employer, the activity, and the nature of the hazard. This section summarizes the key regulatory boundaries; it does not provide a compliance determination for any specific situation.

29 CFR 1910.147 establishes hazardous energy control requirements for servicing and maintenance of machines and equipment in general industry where unexpected energization, startup, or stored-energy release could injure employees. It covers all forms of hazardous energy — electrical, mechanical, hydraulic, pneumatic, chemical, thermal. However, it excludes electrical hazard exposure from work on, near, or with conductors or equipment in electric utilization installations covered by Subpart S of 29 CFR Part 1910. For covered tasks, 1910.147 governs non-electrical hazardous energy sources (mechanical, thermal, pneumatic) and may govern electrical energy from non-utility-side sources depending on the activity and installation. See 29 CFR 1910.147: OSHA’s Control of Hazardous Energy Standard for the full scope analysis.

29 CFR 1910.333 (under Subpart S) establishes electrical safe-work-practice requirements for general industry, including de-energization and lockout/tagging requirements for electrical work on, near, or with conductors or equipment in electric utilization installations. Where BESS work involves electrical hazard exposure covered by Subpart S, 1910.333 governs the electrical energy control requirements — not 1910.147. Both standards may apply simultaneously when a BESS task involves both electrical hazards covered by Subpart S and other forms of hazardous energy covered by 1910.147. See OSHA Requirements for Electrical Safety in the Workplace.

29 CFR 1910.269 governs electric power generation, transmission, and distribution work. It applies to BESS installations that are part of utility generation, transmission, or distribution systems — including utility-scale BESS operated by or for electric utilities. It contains its own energy-control requirements that differ from 1910.147 in significant respects. BESS installations at commercial, industrial, or institutional facilities that are not part of utility T&D systems are generally not within 1910.269’s scope, but the specific facts of the installation and the employer’s operations govern.

NFPA 70E, NFPA 855, and manufacturer documentation are not OSHA regulations. NFPA 70E provides industry consensus guidance on electrical safe work practices and is widely referenced for arc flash and shock hazard analysis; NFPA 855 addresses installation of stationary energy storage systems. Neither is mandated by OSHA as a universal requirement, though OSHA may reference consensus standards in enforcement. Manufacturers’ maintenance manuals and emergency response guides are authoritative for their specific equipment and must be followed — but they are not OSHA regulations.

Applicability of a specific standard to a specific BESS task requires qualified legal and safety professional evaluation of the particular installation, employer, activity, and hazard.

Common BESS LOTO Mistakes

“The AC breaker is open, so the BESS is dead.” The AC breaker isolates grid-side AC energy through that path. Battery DC energy remains. This is the single most dangerous BESS LOTO misconception.

“I shut it down through the HMI/BMS — it’s off.” Software shutdown places the system in a controlled state. It does not open physical isolation devices or remove stored electrochemical energy. Control ≠ isolation.

“The BMS says the contactors are open.” Contactor status feedback is a software-reported state. It does not independently verify absence of voltage at accessible conductors.

“E-stop is LOTO.” E-stops initiate emergency shutdown sequences. They are not energy-isolating devices and do not satisfy LOTO requirements.

“The inverter is isolated, so the battery is isolated.” AC-side inverter isolation removes the AC path. Battery DC energy is on the other side of the inverter. DC-link capacitors in the inverter may retain hazardous charge even after isolation.

“I waited five minutes — capacitors are discharged.” Capacitor discharge times are equipment-specific. Never assign a fixed wait time without consulting manufacturer documentation for the specific equipment.

“LOTO eliminates arc flash risk.” LOTO for BESS work reduces but does not automatically eliminate arc flash risk. Verification steps and certain maintenance tasks may involve exposure to energized conductors. Arc flash hazard assessment, appropriate PPE, and qualified work practices remain relevant. See the Complete Guide to Arc Flash Protection.

“1910.147 governs every BESS task.” As described above, the applicable OSHA standard depends on the installation, employer, activity, and hazard. 1910.333/Subpart S governs electrical hazard exposure in electric utilization installations. Both standards may apply simultaneously.

“A lock makes a charged battery safe.” A lockout device on a disconnect prevents reintroduction of an isolated source. It does not remove electrochemical energy from cells within the isolated section.

“One isolation point is enough.” Multi-source BESS installations require identification and isolation of every source that can deliver energy to the work location, including backfeed paths.

Practical BESS Energy-Control Checklist

This checklist is a planning tool — not a field procedure. Every item must be addressed through applicable employer procedures, manufacturer documentation, and qualified-person evaluation for the specific system and task.

  • ☐ Reviewed current one-line diagrams and manufacturer documentation for this system
  • ☐ Identified every energy source that can deliver energy to the work location (utility AC, alternate AC, each battery string/rack, DC bus, PCS/inverter capacitors, PV inputs, generators, auxiliary/control power)
  • ☐ Identified backfeed paths and alternate energization routes
  • ☐ Confirmed which devices qualify as energy-isolating devices for this task under applicable procedure and standard
  • ☐ Determined the correct isolation boundary for this specific task (not a generic “BESS off” boundary)
  • ☐ Addressed automatic and remote operation pathways (remote shutdown, demand response, automatic charge/discharge)
  • ☐ Applied lockout/tagout devices to every energy-isolating device in the isolation boundary
  • ☐ Allowed manufacturer-specified discharge time for DC-link capacitors and any other time-dependent residual energy
  • ☐ Verified absence of hazardous energy at the point of work using appropriate instruments and procedure
  • ☐ Established ongoing verification plan if stored energy can reaccumulate
  • ☐ Coordinated group LOTO, contractor procedures, and shift-change transfers per applicable requirements and employer procedure
  • ☐ Confirmed system is in normal condition (not thermal runaway, fire-damaged, flooded, or otherwise abnormal) — if abnormal, stopped and obtained qualified assessment

Key Takeaway

BESS LOTO requires a fundamentally different mental model than conventional AC electrical LOTO. The battery is the energy source — isolation controls access to it but does not remove the energy. Every task requires identifying all sources, defining the correct isolation boundary for that task, applying physical lockout/tagout to every energy-isolating device in that boundary, controlling residual energy per manufacturer documentation, and verifying isolation at the point of work before beginning.

Software states, control commands, inverter shutdowns, and open AC breakers do not establish isolation of stored battery energy. Verification is not optional. Damaged or abnormal batteries require qualified assessment before any energy-control procedure is applied.

LOTO is one element of BESS electrical safety. It does not independently resolve arc flash risk, shock hazards from energized DC conductors, thermal runaway, or chemical hazards from damaged cells. See the Complete Guide to NFPA 70E, the Complete Guide to Arc Flash Protection, and the Complete Guide to Electrical PPE for the broader framework.

Related Resources

Recommended Products

Insulated hand tools are relevant to BESS electrical servicing where residual energized conductors may be present or where work on energized components is permitted under applicable requirements, employer procedures, and qualified-person authorization. They do not satisfy LOTO requirements, do not substitute for energy isolation and verification, and do not establish a safe work condition independently.

View Originating Article Source

Safety Notice

The information in this article is for general educational purposes only. It does not constitute legal advice, a compliance determination, a field procedure, or regulatory guidance specific to any employer, installation, or jurisdiction. BESS designs and applicable OSHA requirements vary significantly. Always follow the current regulatory text, the system manufacturer’s documentation, your employer’s energy-control procedures, and the judgment of qualified personnel. LOTO is one element of a BESS safety program — it does not independently address arc flash, thermal runaway, chemical hazards, or other hazards requiring additional controls, PPE, qualified personnel, and emergency response procedures.