LOTO for Industrial Machinery: Electrical Considerations

LOTO for industrial machinery showing a locked electrical disconnect, industrial equipment, multiple energy sources, and hazardous-energy control procedures.

Servicing and maintaining industrial machinery involves hazardous energy in multiple forms simultaneously. Electrical supply is one source among many — and within the electrical category alone, a single main disconnect rarely controls everything. Control transformers, DC power supplies, variable frequency drives, servo drive DC buses, UPS-backed control systems, and interconnected equipment may all remain energized or retain stored charge after the main disconnect is opened.

This article addresses the electrical conditions that must be identified and controlled as part of hazardous energy control for industrial machinery servicing and maintenance. It complements the Complete Guide to Lockout/Tagout for Electrical Systems and the 29 CFR 1910.147: OSHA's Control of Hazardous Energy Standard. It does not replace them, and does not substitute for employer-developed energy-control procedures, manufacturer documentation, or qualified-person evaluation of specific equipment and tasks.

Important framing: This article is for general educational purposes only. It does not constitute legal advice, a compliance determination, or a field procedure for any specific machine, employer, or installation. Always follow current regulatory text, your employer's energy-control procedures, the machine manufacturer's documentation, and the judgment of qualified personnel.

1. Why Industrial Machinery LOTO Is More Than a Disconnect

Industrial machinery is rarely powered by a single, simple energy source. A typical production machine may simultaneously contain electrical energy from one or more supply feeds, control power from a separate transformer or DC supply, one or more VFDs or servo drives with DC-bus capacitors, UPS-backed control systems, hydraulic systems under pressure, pneumatic systems with stored compressed air, mechanical stored energy in springs, counterweights, and suspended loads, and thermal energy in heated platens or fluid systems.

Hazardous energy control requires identifying every energy source for the specific task, establishing the correct isolation boundary for each, and verifying that energy is absent at the point of work before servicing begins. Opening the main electrical disconnect is a necessary first step for many tasks — it is rarely the complete energy-control procedure by itself.

The governing framework for most industrial machinery servicing is 29 CFR 1910.147, but its application is more complex than a single provision and interacts with 29 CFR 1910.333 (Subpart S) when electrical hazard exposure is involved. See Section 14.

2. Map Every Energy Source

Source identification must be based on the actual machine — its schematics, wiring diagrams, hydraulic and pneumatic diagrams, and manufacturer maintenance documentation — not assumption or a generic checklist.

Electrical sources to evaluate include: main AC supply (which may originate from more than one panel or feeder); separate control power circuits (transformer-derived, external DC power supplies, or externally fed); VFD and servo drive DC buses; UPS systems backing control panels or safety systems; separate heating circuits (platens, dies, fluid heaters, heat trace); lighting circuits; external data or control interconnections carrying hazardous voltages; and backfeed from adjacent or interconnected equipment.

Non-electrical sources require equal attention: hydraulic pressure in cylinders, accumulators, lines, and manifolds; pneumatic pressure in cylinders, actuators, and reservoirs; mechanical stored energy in springs, counterweights, suspended tooling, and gravity-loaded slides; thermal energy in hot surfaces and heated fluid systems; and gravity in raised rams, slides, or platens.

Electrical isolation does not control non-electrical energy. A machine that is electrically isolated may still contain pressurized hydraulic circuits, stored spring energy, or a suspended load. The complete energy-control procedure must address every source for the task.

3. Shutdown vs. Energy Isolation

Shutdown stops machine operation. It does not constitute isolation. A shut-down machine may still be energized at its main supply, control circuits, and drive DC buses.

Energy isolation physically places energy-isolating devices in the safe position, preventing hazardous energy from reaching the work location. It follows shutdown and precedes lockout/tagout application.

Lockout/tagout is the application of a lock or tagout device to each energy-isolating device after it is in the safe position.

Stored-energy control is the release, restraint, or dissipation of residual energy remaining after isolation — capacitor discharge, pressure bleeding, blocking suspended loads, releasing spring tension.

Verification confirms that energy is absent at the point of work before servicing begins.

Under 29 CFR 1910.147, the sequence is: notify affected employees → shut down → isolate → apply lockout/tagout → control stored/residual energy → verify. These are sequential steps. No step substitutes for another.

4. What Qualifies as an Energy-Isolating Device

Under 29 CFR 1910.147, an energy-isolating device is a mechanical device that physically prevents the transmission or release of energy. Examples include manually operated circuit breakers, disconnect switches, line valves, and blocks — devices that physically interrupt energy flow and can be locked or tagged in the safe position.

Devices that are not energy-isolating devices under 1910.147 include: push buttons and selector switches; PLC outputs, HMI commands, and software-controlled states; safety PLC states or safety relay de-energization; interlocks and safety gates; E-stops and remote shutdown commands; motor contactors controlled by the machine's control system; and drive enable/disable signals.

A software state or control signal cannot be locked. It can be altered, overridden, or reversed by another control input. Physical isolation prevents energy from being restored except by deliberate physical reversal — which cannot occur while a lock is in place.

Whether a specific device qualifies as an energy-isolating device depends on its design, its ability to physically interrupt energy flow, and whether it can be locked in the safe position. Employer procedures and qualified-person evaluation determine which devices serve this function for specific machines and tasks.

5. Main Disconnects and Multiple Electrical Feeds

The main electrical disconnect controls only what it is wired to control. Multiple electrical feed arrangements are common and must be identified before assuming a single lockout covers all electrical sources.

Conditions that can leave electrical energy present after the main disconnect is locked out include: separate control-power feeds not switched by the main disconnect; auxiliary heater circuits on separate branch circuits; lighting circuits on separate branch circuits; external interlocks powered from facility infrastructure; separately supplied drives or cabinets with their own supply disconnects; UPS-backed controls maintaining PLC or HMI power; and interconnected machine feeds through shared DC buses or conveyors.

The employer's energy-control procedure, based on actual machine schematics and as-built drawings, governs which disconnects must be operated and locked for a specific task. Never assume the main disconnect is the only required isolation point without verifying against actual documentation.

6. Control Power, PLCs, HMIs, and Remote Commands

Control transformers may be connected before the main disconnect or fed from a separate circuit. Opening the main disconnect may or may not de-energize the control transformer — verify from actual schematics.

UPS-backed control systems maintain operation during main-supply interruptions by design. A machine with UPS-backed controls will have an energized control panel and active PLC after the main disconnect is opened. The UPS must be identified and addressed in the energy-control procedure.

PLC/HMI states are not energy isolation. A PLC in any state — stop, safe state, e-stop, or fault — is executing a control program. It does not physically prevent power from being present in connected circuits, solenoid coils, drive power stages, or other downstream components. PLC and HMI states do not verify or guarantee the absence of voltage at any point in the machine's circuits.

Remote and network-based commands can restart a machine regardless of local physical state. A machine shut down via network command can receive a network restart command while personnel are working on it. Remote command pathways must be addressed in the energy-control procedure. Software inhibits are control measures — not physical isolation.

7. VFDs, Servo Drives, and Stored DC-Bus Energy

VFDs and servo drives rectify incoming AC power to a DC bus voltage and then synthesize AC output to the motor. This architecture creates stored energy that persists after input power is removed.

A stopped motor does not indicate a discharged drive. When a drive commands a motor to stop, the motor halts. The DC-bus capacitors may still be charged to hazardous voltage levels. A drive display showing "stopped" or "disabled" reflects a control state — not the absence of stored electrical energy.

Opening the input disconnect does not immediately de-energize the DC bus. Stored energy remains until it dissipates. Discharge times vary by manufacturer, drive rating, and DC-bus capacitance. They are specified in the manufacturer's documentation and must not be assumed or invented. Never substitute a fixed universal wait time — always consult the specific drive's manufacturer documentation for the specific equipment being serviced.

Regenerative drives and shared DC buses add complexity. In multi-drive systems sharing a common DC bus, opening one drive's input disconnect does not remove energy from the bus if other drives remain connected. Shared-bus architectures must be evaluated as a system.

Verification is required. After allowing manufacturer-specified discharge time, absence of hazardous voltage must be verified using appropriate instruments and the applicable procedure before internal drive components are accessed. Drive status displays and indicator lights are not verification.

8. Motors, Brakes, and Mechanical Stored Energy

Residual motor rotation: A de-energized motor may continue rotating due to mechanical inertia. This represents a motion hazard that persists after electrical isolation. The machine must come to a complete stop before exposure to moving components.

Motor-operated brakes: Many machines use spring-applied, electrically released brakes. De-energization applies the brake — which may be the intended safe condition. However, some configurations use electrically applied brakes (released when power is removed). Understand the specific brake design and its effect on suspended loads or other machine components.

Suspended loads and gravity energy: Components that can move under gravity must be supported, blocked, or restrained before personnel work under or near them. Electrical isolation alone does not prevent a suspended load from falling if the brake releases or a hydraulic cylinder loses pressure. The employer's procedure must address gravity hazards for each machine and task.

Flywheels and rotating inertia: High-inertia rotating components must be allowed to coast to a complete stop — or be positively blocked — before exposure.

9. Hydraulic, Pneumatic, Gravity, and Spring Energy

Hydraulic systems store energy in accumulators, pressurized lines, and cylinders. Stopping the hydraulic pump motor stops new energy input but does not remove pressure stored in the system. Hydraulic accumulators may retain pressure for extended periods. Bleeding pressure requires following the manufacturer's procedure for the specific system.

Pneumatic systems retain compressed air in cylinders, actuators, and air lines. A line valve isolating the supply does not release pressure stored downstream. Bleeder or exhaust valves must be operated per the employer's procedure before servicing pneumatic components.

Gravity energy is present wherever a component can descend under its own weight. Electrical isolation can remove the power holding a component raised — introducing a gravity hazard. Mechanical blocking must be used before working under raised components. Never rely solely on a hydraulic or pneumatic holding circuit to support a load during servicing. Spring energy in clutches, cams, dies, and actuators must be assessed for each task per the energy-control procedure and manufacturer documentation. Thermal energy in heated platens and process fluids persists after electrical isolation — allow adequate cooling time per manufacturer and employer procedure before contacting heated components.

10. Backfeed and Interconnected Equipment

Common backfeed scenarios include: shared DC buses where multiple drives can energize the bus from any connected drive's input or from a regenerative drive's load side; mechanical interconnection through conveyors where a powered adjacent section rotates a coupled isolated section's motor as a generator; shared control networks where a local shutdown does not prevent a network-originated restart command; utility transfer and alternate supply paths through automatic transfer switches or facility UPS; and adjacent equipment through open guards, shared work zones, or mechanical coupling. Backfeed analysis must be based on actual machine arrangement, electrical one-line diagrams, and control-system architecture. The energy-control procedure must address every identified backfeed path.

11. Lockout/Tagout Application and Verification

Under 29 CFR 1910.147(d)(4), each authorized employee must apply their own personal lockout device to each energy-isolating device after it has been placed in the safe position. Applying a lock to a device not yet in the safe position is not lockout. Under 1910.147(d)(5), stored energy must be released, restrained, or rendered safe before work begins — allow manufacturer-specified discharge times for VFD and servo drive DC buses and follow applicable procedures for all other stored-energy types. Under 1910.147(d)(5)(ii), if stored energy can reaccumulate to hazardous levels, the situation must be monitored until servicing is complete. Under 1910.147(d)(6), the authorized employee must verify isolation and de-energization before work begins — for electrical circuits, verification means testing, not reading a display, not relying on indicator lights, and not relying on PLC status.

For group LOTO, contractor coordination, and shift-change requirements, see the Complete Guide to Lockout/Tagout for Electrical Systems and the 29 CFR 1910.147 article.

12. Testing and Positioning That Requires Energization

Under 29 CFR 1910.147(f)(1), if re-energization is necessary for testing or positioning, the required sequence is: (1) clear the machine of tools and materials; (2) remove all employees from the machine area; (3) remove lockout or tagout devices per the applicable procedure; (4) energize and proceed with testing or positioning; (5) de-energize and reapply all energy controls before any employee resumes servicing. This is a defined exception for a specific narrow circumstance — not a general authorization for energized troubleshooting during servicing. Energized electrical work involving exposure to energized conductors is subject to 29 CFR 1910.333/Subpart S requirements. See the Complete Guide to Energized Electrical Work.

13. Machine Guarding, Interlocks, and Minor Servicing

Machine guarding prevents contact with hazardous parts during normal operation. LOTO controls hazardous energy during servicing when guards are removed or bypassed. An interlock is a control-circuit device — not an energy-isolating device. An interlocked guard does not remove power from electrical circuits, VFD DC buses, or hydraulic systems. LOTO is required for covered servicing activities regardless of guarding and interlocks in place. The minor servicing exception under 1910.147(a)(2)(ii) applies only to minor tool changes, adjustments, and other minor servicing activities during normal production operations when the activity is routine, repetitive, and integral to production, and when alternative measures provide effective protection. OSHA interprets this exception narrowly — it does not apply to general maintenance, troubleshooting, or tasks involving removal of guards or exposure to hazardous energy beyond what the alternative measures address. See OSHA Subpart O (29 CFR 1910.211–217) for machine guarding requirements.

14. 1910.147 vs. 1910.333/Subpart S

29 CFR 1910.147 covers hazardous energy control for servicing and maintenance where unexpected energization, startup, or release of stored energy could injure employees, addressing all forms of hazardous energy. However, 1910.147 explicitly excludes electrical hazard exposure from work on, near, or with conductors or equipment in electric utilization installations covered by Subpart S (29 CFR 1910.301–399). 29 CFR 1910.333 (Subpart S) establishes electrical safe-work-practice requirements for general industry, including de-energization and lockout/tagging requirements for electrical work on, near, or with conductors in electric utilization installations.

OSHA has explained that mechanical servicing of electrically powered machinery — where the hazard is unexpected startup or mechanical energy release — is covered by 1910.147. Electrical work on the machine's conductors or equipment — where the hazard is exposure to energized electrical parts — is covered by 1910.333/Subpart S. Both can govern different aspects of the same job, and where both apply, both must be satisfied. Applicability to a specific task requires qualified legal and safety professional evaluation. See OSHA Requirements for Electrical Safety in the Workplace.

15. Common Industrial Machinery LOTO Mistakes

"The main disconnect is open — the machine is safe." It controls its served circuits only. It does not remove control transformer power, UPS-backed supplies, VFD DC-bus stored energy, or separately fed circuits. It does not control hydraulic, pneumatic, or mechanical stored energy.

"I stopped it from the HMI/PLC — it's isolated." PLC and HMI commands are not physical energy isolation. Power circuits, drive DC buses, and control supplies may all remain energized.

"The E-stop is engaged." E-stops initiate a controlled stop. They are control-circuit devices, not energy-isolating devices, and do not satisfy LOTO requirements.

"The motor is stopped, so the drive is safe." A stopped motor does not indicate a discharged VFD or servo drive DC bus. Follow manufacturer discharge documentation for the specific drive and verify before accessing drive internals.

"I waited long enough for the capacitors to discharge." Discharge times are drive- and equipment-specific. There is no universal safe wait time. Follow manufacturer documentation and verify where required.

"The indicator light is off." Indicator lights reflect control-circuit states. They do not confirm the absence of voltage in power circuits. Always verify using appropriate instruments per the applicable procedure.

"Electrical LOTO controls the hydraulic energy." Stopping the pump motor does not remove pressure stored in cylinders, accumulators, hoses, and manifolds. Hydraulic pressure must be bled per the applicable procedure.

"The interlock will prevent startup." Interlocks are control-circuit devices. They do not remove power, discharge drive DC buses, or control stored energy, and do not satisfy LOTO requirements.

"One disconnect controls the whole machine." Verify from actual machine schematics. Multiple feeds, separate control power supplies, and UPS-backed systems are common.

"LOTO eliminates arc flash risk." Verification steps and troubleshooting may involve exposure to energized conductors where arc flash and shock hazards remain present. See the Complete Guide to Arc Flash Protection.

16. Practical Energy-Control Planning Checklist

This checklist is a planning tool — not a field procedure. Every item must be addressed through the applicable employer procedure, machine manufacturer's documentation, and qualified-person evaluation for the specific machine and task.

  • ☐ Obtained and reviewed current machine schematics, wiring diagrams, hydraulic/pneumatic diagrams, and manufacturer maintenance documentation
  • ☐ Identified every energy source for the specific task: main AC supply source(s); control power source(s); VFD/servo drive DC buses; UPS-backed systems; heating circuits; hydraulic systems; pneumatic systems; mechanical stored energy (springs, suspended loads, counterweights); gravity hazards; thermal hazards
  • ☐ Identified backfeed paths: shared DC buses, mechanical interconnections, network-based restart pathways, alternate supply sources, interconnected adjacent equipment
  • ☐ Confirmed which devices qualify as energy-isolating devices (not push buttons, selectors, PLCs, interlocks, or E-stops)
  • ☐ Confirmed each energy-isolating device can be locked in the safe position per the applicable procedure
  • ☐ Identified control power source(s) and whether isolated by the main disconnect or requiring separate isolation
  • ☐ Determined manufacturer-specified VFD/servo drive DC-bus discharge procedure and time for the specific drives installed
  • ☐ Addressed remote and network-based restart pathways
  • ☐ Notified affected employees per the employer's procedure
  • ☐ Shut down per the manufacturer's and employer's procedure
  • ☐ Operated all energy-isolating devices to the safe position
  • ☐ Applied personal lockout/tagout device(s) to each energy-isolating device (or to group hasp per group procedure)
  • ☐ Allowed manufacturer-specified discharge time for VFD/servo drive DC-bus capacitors
  • ☐ Controlled stored hydraulic, pneumatic, mechanical, and thermal energy per the employer's procedure
  • ☐ Blocked or supported suspended loads, gravity hazards, or spring-loaded components per the employer's procedure
  • ☐ Verified absence of hazardous energy at the point of work using appropriate instruments and procedure
  • ☐ Established ongoing verification plan if stored energy can reaccumulate
  • ☐ Coordinated group LOTO, contractor procedures, and shift-change transfers per applicable requirements

17. Key Takeaway

LOTO for industrial machinery is an all-energy-types discipline. A main disconnect controls the main AC supply — it does not automatically control control-transformer power, UPS-backed systems, VFD DC-bus stored energy, hydraulic pressure, pneumatic pressure, spring energy, or suspended loads. PLC states, HMI displays, software inhibits, interlocks, and E-stops are control-circuit functions. None constitute physical energy isolation or satisfy LOTO requirements.

VFD and servo drive DC buses retain hazardous voltage after input power is removed. Discharge time is equipment-specific. A stopped motor does not indicate a discharged drive. Always follow manufacturer documentation and verify before working in the drive's hazard zone.

The sequence — shutdown, isolate, apply LOTO, control stored energy, verify — is required and sequential under 29 CFR 1910.147. Where work also exposes employees to electrical hazards from live parts, 29 CFR 1910.333/Subpart S applies. Both can govern different aspects of the same job. See the Complete Guide to Arc Flash Protection, the Complete Guide to NFPA 70E, and the Complete Guide to Electrical PPE for the broader framework.

Related Resources

Recommended Products

Insulated hand tools are relevant to industrial machinery electrical servicing tasks where residual energized conductors may be present, or where work on energized components is permitted under applicable requirements and employer procedures. They do not satisfy LOTO requirements, do not substitute for energy isolation and verification, and do not establish a safe work condition independently.

View Originating Article Source

Safety Notice

The information in this article is for general educational purposes only. It does not constitute legal advice, a compliance determination, a field procedure, or regulatory guidance specific to any employer, machine, or jurisdiction. Always follow the current regulatory text, the machine manufacturer's documentation, your employer's energy-control procedures, and the judgment of qualified personnel. LOTO is one element of industrial machinery safety — it does not independently address arc flash, shock hazards during energized work, or mechanical hazards from non-electrical energy sources requiring additional controls, qualified personnel, and appropriate PPE.