Electrical Disconnect Lockout: OSHA 1910.147 Procedures for Switchgear, Panels, and MCCs
Electrical work draws a disproportionate share of LOTO citations and a larger share of the fatalities. The cited fact pattern repeats: the main disconnect was opened, but a control transformer kept feeding the panel, or a downstream VFD was treated as isolation, or the verification step was a non-contact tester waved at an enclosure. None of those are 1910.147 compliant. This is the senior EHS read on electrical disconnect lockout, how it sits beside Subpart S, what an audit-grade procedure looks like at switchgear, distribution panels, and motor control centers, and the verification step that decides whether the job is electrically safe or not. It pairs with our stored energy isolation piece and our group lockout procedures piece for the broader program picture.
Where the Electrical Lockout Lives in the Standards
The cleanest way to think about it: 1910.147 is the program standard, and Subpart S is the electrical safety standard. They overlap, and electrical disconnect lockout sits squarely in the overlap. The OSHA 1910.147 text requires that energy isolating devices be operated to isolate the equipment from the energy source, then locked. 1910.333 requires that, before any work begins on or near exposed energized parts, a qualified worker either de-energize and verify with a tested instrument, or work on the live circuit under written energized-work permit conditions.
That layering matters. Industry overwhelmingly relies on NFPA 70E to operationalize 1910.333, and OSHA accepts the NFPA 70E-style live-dead-live verification as the way to prove the absence of voltage. A 1910.147 procedure for an electrical disconnect that does not include verification will satisfy the energy isolation paragraph and fail the Subpart S verification paragraph at the same time. Inspectors treat both as in scope on the same machine.
What Counts as an Energy Isolating Device for an Electrical Source
1910.147 defines an energy isolating device as a mechanical device that physically prevents the transmission or release of energy. For electrical sources, that narrows to a short list: a manually operated circuit breaker, a fused disconnect switch, a knife switch, a draw-out circuit breaker racked to the disconnected position, or a slide-out plug-in unit on an MCC racked out and locked. The common thread is that the device physically separates the conductors and accepts a lock in the off or disconnected position.
That definition excludes more than it includes. A push-button stop is not an energy isolating device. A control relay is not. A VFD enable input is not. A safe-torque-off circuit on a servo drive is not. A motor starter coil that the worker assumes will stay dropped out is not. The standard is specific because each of those exclusions has a fatality record. A driveshaft turns over because a coil pulled in on a stray PLC bit, or a VFD output energizes because a parameter was reloaded, and the worker is touching the conductors.
Practically, that means the procedure has to identify the actual disconnect that physically separates the supply. For a motor on an MCC bucket, that is the bucket disconnect itself, not the local stop at the load. For a hard-wired panel fed from switchgear, it is the panel main breaker or the upstream feeder breaker, depending on which one is rated and labeled as the disconnecting means. For a transformer feeding a distribution panel, both the primary and secondary need treatment if the secondary can be backfed.
Multiple Sources, Backfeeds, and the Source Map
The single most common fatality pattern is the missed second source. A maintenance crew locks the main feeder, opens the enclosure, and contacts conductors that are still energized from a control power transformer, an emergency generator with an automatic transfer switch, a UPS bus tie, a backup feed used during outages, or a downstream load that can backfeed when the line side opens. Multi-source equipment includes more facilities than people think. Anything with redundant power, any cell on an automated line with separate control and motor power, anything tied to an inverter, and anything with stored energy in capacitor banks or DC bus links.
The fix is a source map per piece of equipment in the machine-specific energy control procedure. The map names every disconnect, every potential backfeed, and every control source, and it is reviewed when the electrical system changes. The procedure then locks each one. A site that performs an annual 1910.147(c)(6) inspection without updating the source map for changes in the electrical distribution will find itself locked to the wrong picture. Our periodic inspection checklist covers the document-level review that catches this.
Stored Energy in Electrical Systems
Electrical sources store energy in three forms the procedure has to address. Capacitor banks on power factor correction, harmonic filters, and large drive DC links can hold hundreds of volts after isolation, sometimes for minutes. Spring-charged operating mechanisms on medium-voltage switchgear hold mechanical energy that has to be relieved before the breaker can be safely opened or worked on. Battery and UPS systems hold DC energy that does not disappear when the AC main opens.
The procedure has to name the discharge step for each. Capacitors discharge through built-in bleed resistors over a defined interval (the equipment nameplate or the manufacturer's documentation has the number) or through a deliberate ground stick if the documentation specifies one. Spring mechanisms are discharged by operating the breaker to the closed position with the racking interlock engaged, then opening it again, per the manufacturer's procedure. Batteries and UPS units are isolated at their own disconnects and the DC bus is verified dead the same way the AC system is.
Skipping the stored-energy step is the second most common citation in this category after missed sources. A worker locked the main, waited five seconds, opened the enclosure, and contacted a capacitor that still carried 600 volts DC. Our piece on hydraulic, pneumatic, and capacitive stored energy goes deeper on the discharge analysis.
Verification: The Live-Dead-Live Test
Verification is where 1910.147 and NFPA 70E lock together. The standard requires the authorized employee to verify that the equipment is isolated and de-energized before work begins. For electrical work, the accepted method is the live-dead-live test with a meter and PPE rated for the system.
- Test the meter on a known live source. This proves the meter functions. The source has to be at the same voltage class as the circuit being verified, and within reach without expanding the arc-flash boundary.
- Test the de-energized circuit. Phase-to-phase and phase-to-ground at every conductor that should be dead. On a three-phase circuit, that is six readings minimum.
- Re-test the meter on the known live source. This proves the meter still functions, ruling out a fuse blown or a probe broken during the dead-circuit test.
A non-contact voltage detector is useful as a presence test but it does not satisfy verification on its own. The current edition of NFPA 70E and OSHA's interpretation letters are clear on the point. The procedure has to name the meter, the test sequence, and the PPE.
Arc-Flash Boundary and the Pre-Verification Window
The moment a worker opens an electrical enclosure to perform the verification test, they are doing energized work. The arc-flash incident energy at the working distance controls PPE for that step. After verification confirms zero, the work transitions to the electrically safe work condition defined by NFPA 70E, and PPE for the mechanical scope can be relaxed.
That short pre-verification window is what makes electrical LOTO procedurally different from mechanical LOTO. The lockout procedure has to name the arc-flash boundary, reference the site's arc-flash study and the incident energy at the working distance, and specify the PPE rating. A LOTO procedure that ignores the arc-flash question and assumes the moment the lock goes on the work is safe is missing the period when the worker is most exposed. The fatal events in this category usually occurred during verification or during the energized work needed to confirm the absence of voltage.
Switchgear, Panels, and MCCs: Three Common Setups
The procedure looks different at each enclosure type. The principles do not change but the disconnect and the stored-energy analysis do.
| Equipment | Isolating device | Stored energy to address | Verification location |
|---|---|---|---|
| Low-voltage panelboard | Main breaker locked off, or upstream feeder breaker | Capacitors on connected drives (verify per drive manual) | Load side of main breaker, phase-to-phase and phase-to-ground |
| Motor control center bucket | Bucket disconnect locked off, bucket racked out where applicable | Motor capacitor on the load side (if present), control transformer | Load side of bucket disconnect at the outgoing terminal block |
| Medium-voltage switchgear | Draw-out breaker racked to disconnected position, locked in place | Spring-charged operating mechanism discharged per manufacturer, capacitor banks per nameplate | Visible disconnect gap and load-side bus verified with hot stick or appropriate MV meter |
| VFD-driven load | Upstream disconnect to the drive, not the drive's safe-off input | DC bus capacitor (manufacturer-specified bleed time) | Drive output terminals, motor leads at the motor terminal box |
| Multi-source equipment | Every feeder, control power source, UPS, and backfeed path locked | Capacitors, batteries, springs as applicable | Each circuit verified independently at its own load point |
The pattern across all five rows: the isolating device is upstream of any electronic or control element, the stored energy step is specific to the equipment, and the verification is at the actual working terminals, not at the disconnect itself. A meter reading on the line side of an open breaker tells you the breaker did its job. It does not tell you the conductors at the work location are dead. Bring the meter to the work.
Documentation, Training, and the Audit Trail
The machine-specific procedure for an electrical lockout has to include the equipment identification, every energy source, the specific isolation steps in sequence, the stored-energy release, the verification method, and a reference to the arc-flash analysis. The authorized employee performing the work has to be trained on both the energy control side under 1910.147(c)(7) and the electrically qualified side under 1910.332 and 1910.333. Those are different trainings with different records. An inspector who finds a generic energy control procedure that says "open the disconnect and lock it" with no source map, no stored-energy step, and no verification protocol has the citation written before the next question.
The qualified-worker training records also need a clear line to the actual electrical work the employee is authorized to perform. A worker qualified for low-voltage panelboard work is not automatically qualified for medium-voltage switchgear, and the records should make that distinction.
Three Moves to Make This Month
Three priorities surface most of the electrical LOTO exposure in any program:
- Pull every machine-specific energy control procedure that lists an electrical source. Confirm each one names the actual isolating device, every secondary source including control power and UPS, the stored-energy discharge step, and a live-dead-live verification protocol. The procedures that read "lock out main disconnect, verify de-energized" without specifics are the ones that fail.
- Cross-check the source map against the current electrical one-line and any recent changes (added VFDs, UPS bus, emergency feed, generator transfer). The number of facilities running locked-out procedures against a five-year-old one-line is high enough that this single audit usually turns up findings.
- Confirm the qualified-worker roster lines up with the arc-flash analysis and the verification PPE specified in the procedures. A procedure that requires Category 3 PPE is only useful if the worker performing the verification has Category 3 PPE on site and has been trained to use it.
If any of those three turns up gaps, that is the call point. ECPL builds the machine-specific procedures, names the isolating devices and the verification points, integrates the arc-flash data into the LOTO file, and trains the authorized and qualified employees. We work out of Chicago, Detroit, and Indianapolis with national travel. See the full scope on our services page. The assessment is free.
Free LOTO Assessment
ECPL audits your electrical disconnect procedures against 1910.147, 1910.333, and NFPA 70E, identifies missing sources and verification gaps, and quotes the fix.
Request Your AssessmentFrequently Asked Questions
Does 1910.147 or 1910.333 apply to electrical disconnect lockout?
Both, and they apply at the same time. 1910.147 covers the broader energy control program and the lockout of any energy source that could start up equipment during servicing. Subpart S, specifically 1910.333, governs work on or near exposed electrical conductors. When a maintenance task involves opening an electrical enclosure, the energy control side runs under 1910.147 and the electrical safe work practices run under 1910.333. They are not alternatives. They are layered.
Is opening a panel and racking out a breaker enough to satisfy 1910.147?
Not on its own. The standard requires the disconnect to be opened, the lock applied, stored energy released, and verification performed. Racking out a draw-out breaker is the isolation step. The lock on the rack-out position, the stored-energy bleed on any capacitors or springs, and the absence-of-voltage test with a meter rated for the circuit are what make the procedure compliant. Skipping any one of those is a finding.
What is the right verification method for an electrical disconnect lockout?
Test the meter on a known live source, test the de-energized circuit phase-to-phase and phase-to-ground at every conductor expected to be dead, then re-test the meter on the known live source. That is the live-dead-live test sequence required by NFPA 70E and accepted by OSHA. Use a meter and PPE rated for the voltage and arc-flash incident energy. A non-contact voltage detector does not satisfy the verification requirement for work on exposed conductors.
Can one lock cover multiple electrical disconnects feeding the same equipment?
No. Every energy isolating device that could energize the equipment has to be locked, including dual feeds, control power, UPS or battery backup, and any local disconnect at the load. Multi-source equipment is one of the most common sources of fatalities because the worker locked the main and missed a control transformer or a backup supply. The machine-specific energy control procedure has to name every source.
Does a control-circuit stop or VFD enable count as energy isolation?
No. Control-reliable safe-torque-off and VFD safe-off functions are protective stop functions, not energy isolation under 1910.147. The standard requires a physical disconnect that can be locked in the off position and that visibly separates the conductors. A VFD output can be inadvertently energized by a control fault, a software reset, or a misapplied parameter. The upstream disconnect is the lockable device.
How does arc-flash risk factor into an electrical disconnect lockout procedure?
Until the absence-of-voltage test is complete, the worker is performing energized work and the arc-flash incident energy at the working distance controls PPE. After the test confirms zero energy, the task drops to electrically safe work condition and PPE can be relaxed for the mechanical portion of the job. The lockout procedure and the arc-flash analysis are different documents that have to be consistent. A LOTO that does not name the arc-flash boundary is missing half the picture.