Automation changed the energy picture faster than most LOTO procedures kept up. A robot arm holds gravity and compressed air. A VFD holds a lethal DC-bus charge for minutes after its disconnect opens. A servo axis can regenerate voltage while it coasts. And a machine that "restarts itself" after a power dip adds a hazard that no vintage procedure mentions.
This guide covers the energy that automated equipment adds beyond the classic disconnect-and-lock picture, how to isolate and verify it, and the rule that trips the most teams: interlocks are not lockout.
Why automation changes the energy picture
OSHA 1910.147 still governs — unexpected energization, start-up, or stored-energy release during servicing — but automated equipment concentrates the stored-energy problem. The disconnect may be open while the DC bus still holds charge, the robot arm still holds position against gravity, and the control network still holds the command that will re-energize the moment power returns.
Start the assessment (see the energy assessment guide) with the assumption that nothing is safe just because a main switch is open, then prove each source individually.
VFDs and drives: the DC bus that outlives the disconnect
Variable-frequency drives power the machine, then keep a DC-bus capacitor bank charged for seconds to many minutes after input power is removed. For large drives the retained voltage can be lethal, and the bus can be re-charged from the motor side as it coasts or regenerates.
- Follow the manufacturer’s stated discharge time for the specific drive — it is in the manual, and your procedure should name it.
- Verify with a rated meter that the DC bus is below the safe threshold before touching terminals — never trust elapsed time alone.
- Confirm the disconnect also de-energizes control power; drives with separate control circuits stay live after the main breaker opens.
- Add the capacitor discharge step to the stored-energy section and re-verify immediately before work — the bus can re-accumulate from a powered control circuit.
Robots and servo axes: gravity, brakes, and stored air
A robot in the home pose is not a safe pose. The arm holds gravitational potential, brakes hold it in place, counterbalance gas springs hold some of the weight, and grippers hold compressed air or mechanical force. When power drops, a brake fault or a vented cylinder can move the arm on its own.
- Move the robot to the safe/teach pose and disable per the OEM procedure before any work inside the cell.
- Treat brakes as untrustworthy during servicing: mechanically block, pin, or strap the arm where a motion could reach the worker.
- Release or verify stored air in grippers and auxiliary cylinders, and note counterbalance gas springs as stored energy in the procedure.
- For servo axes, verify by attempting motion in test mode with the machine disabled and by confirming drives are discharged — then confirm the teach pendant cannot re-energize the cell.
Interlocks are access control, not isolation. Follow Tegis on Google for automation-specific LOTO guides.
Capacitors, batteries, and backup power
Automation adds energy sources that survive the main disconnect: capacitor banks, UPS-backed PLCs, and batteries powering memory, sensors, or safety circuits. Treat each as its own line in the energy table:
- Discharge capacitors through rated means — bleed resistors or a rated discharge tool — and verify with a meter reading at the terminals.
- Isolate UPS and battery feeds separately; they are not switched by the machine disconnect and can back-feed control circuits.
- Include network and pneumatic actuation: a solenoid or valve actuator can move the machine from a control signal even with main power off.
- Re-verify after any wait — these sources re-accumulate and can re-energize the machine unexpectedly.
Interlocks are not lockout
Light curtains, interlocked guards, and presence-sensing devices protect operators during normal production — they are access control, not energy isolation. During servicing, a bypassed interlock or a maintenance mode that keeps the drive powered leaves the machine one fault away from motion.
Interlocks may support minor servicing exceptions in narrow, documented cases with effective alternative protection — but for real maintenance on automated cells, the procedure must isolate the energy, not trust the light curtain. When in doubt, lock out.
Writing procedures that fit automated cells
An automated cell usually needs its own procedure, not a line in a general one. Structure it around the cell: every energy feed (power, control, compressed air, coolant, network actuation), the sequence to reach a safe state (home pose, brakes, discharge), the stored-energy list with release and verification, and the restart sequence that clears the cell before power returns.
Involve the integrator and OEM documentation in the assessment, brief contractors and robot service vendors under the outside-personnel rules, and re-assess whenever the cell is modified or reprogrammed — automated equipment changes energy sources without changing its nameplate.
Key takeaways
- Automation concentrates stored energy: VFD DC buses, robot gravity, servo regen, batteries, and network actuation all outlive the main disconnect.
- Verify each source individually — rated meter readings for drives and capacitors, physical blocks for robot axes, gauges for stored air.
- Interlocks and light curtains are access control, not isolation; maintenance requires energy isolation, not a maintenance mode.
- Re-verify immediately before work — capacitor buses and backup feeds can re-accumulate after release.
- Give every automated cell its own procedure, sourced from OEM documentation and the people who service it, and re-assess on any modification.
Frequently asked questions
Do we have to de-energize the robot completely?
The energy that can injure you must be controlled — the robot must be in a safe pose, unable to move, and any remaining energy (stored air, counterbalance springs, drive charge) released or verified. That typically means disabling per the OEM procedure, mechanically securing where needed, and verifying before entering the cell.
How long do VFD capacitors hold a charge?
From seconds to many minutes depending on the drive size and bleed circuitry; large drives can retain lethal DC-bus voltage well after the disconnect opens. Follow the manufacturer’s stated discharge time and always verify with a rated meter at the bus before touching anything.
Does NFPA 70E or 1910.333 apply to electrical work here?
For work on or near exposed energized parts, electrical safety-related work practices (1910.333 and NFPA 70E) apply alongside 1910.147. LOTO establishes the energy isolation; electrical standards govern how the work is performed, including safe approach and testing procedures. Use both, in order.
Do collaborative robots still need LOTO?
Yes. Cobots are designed to be safe for people working alongside them in production — they are not designed to eliminate the hazards of maintenance, where a technician may be inside the workspace, hands near moving parts, or working on the drive system. Servicing still requires energy isolation per the machine-specific procedure.
What about automatic restart after a power dip?
That is a real hazard and a common gap: machines configured to auto-restart can re-energize after a momentary power loss, moving parts while no one expects it. The procedure must cover re-energization behavior, and servicing requires isolation that prevents automatic restart — not just a pause in the cycle.