June 3, 2026 · Hazardous Energy Control
The most dangerous assumption on a plant floor is that a locked-out robot is a dead robot. It is not. A disconnect padlocked in the off position has isolated the incoming electrical energy, and that is the necessary first step. But an industrial robot cell holds energy in at least half a dozen places that the disconnect does not touch, and the workers most at risk are the maintenance technicians and integrators who climb into the cell trusting that the lock did all the work.
This guide walks through residual and stored energy on a robot cell the way a senior controls and EHS engineer has to think about it. Where the energy hides, why a robot arm can drop after power is removed, how long a servo drive stays lethal after disconnect, and what a complete energy-control procedure has to verify before the cell is safe to enter. The plants we audit across Grand Rapids, Holland, Kalamazoo, and Battle Creek consistently have good locks on the main disconnect and incomplete control of everything downstream of it.
OSHA 1910.147 is explicit on this point, and it is the part of the standard most frequently misread. Paragraph (d)(5)(ii) states that following the application of lockout devices, all potentially hazardous stored or residual energy must be relieved, disconnected, restrained, or otherwise rendered safe. The lock on the disconnect satisfies the isolation step. The stored-energy step is separate, and it is where robot cells fail.
The reason is the nature of a robot. Unlike a simple machine that coasts to a stop and stays there, a multi-axis robot is a system of loaded masses held in position by active and passive forces. Remove the electrical supply and the holding forces change state. Some loads are now held only by mechanical brakes. Some pressurized systems retain their charge indefinitely. The drive electronics stay live on stored charge. The cell has not reached a zero-energy state simply because the lock is on.
This distinction is the same one we draw between safeguarding and isolation in our robotic palletizer LOTO walkthrough. Presence-sensing safeguards stop the cell during production. LOTO and stored-energy control protect the worker inside the cell during service. Neither substitutes for the other.
A complete energy-control procedure for a robot system has to identify and address every source present. Six are common, and a given cell usually has four or five of them.
| Energy source | Where it hides | Control method |
|---|---|---|
| Gravity | Vertical and counterbalanced axes, heavy end-of-arm tooling | Block, support, or restrain the axis before work |
| Pneumatic | Cylinders, accumulators, end-of-arm grippers, air balancers | Bleed to zero, confirm with gauge, lock the supply valve |
| Hydraulic | Spot-weld guns, clamps, hydraulic balancers | Relieve pressure, confirm zero, restrain loaded actuators |
| Mechanical spring | Brakes, counterbalances, tool changers, tensioners | Confirm set or release in a controlled, restrained manner |
| Electrical (capacitive) | Servo drive DC bus, power supply capacitors | Wait the discharge time, verify zero voltage with a meter |
| Thermal | Servo motors, braking resistors, weld equipment | Allow cooling, confirm safe temperature before contact |
The single most underestimated hazard on a robot cell is gravity acting on a vertical axis. Every six-axis industrial robot holds its position through spring-applied, electrically released brakes on each axis. When power is present, the brakes are held open and the servo motors maintain position. When power is removed, the brakes set. That is the fail-safe design, and it works as intended on a healthy robot.
The risk appears in three situations. A worn brake whose holding torque has degraded below the load. A heavily loaded upper arm or a dense end-of-arm tool that approaches the brake rating. And the service procedure that intentionally releases a brake to move an axis by hand. In any of these, a vertical axis can drift or drop the moment the brake gives or is released, and a technician beneath the J2 or J3 axis is in the fall path.
The control is physical, not procedural. Before a worker is exposed beneath a vertical axis, the axis is blocked with a rated mechanical support, a stand, or a restraint that does not depend on the brake. The robot manufacturers publish brake-release and axis-support procedures for exactly this reason, and a cell-specific LOTO procedure has to incorporate them rather than assuming the brake will hold.
The hazard that surprises electricians new to robotics is the charge that remains in the servo drive after the supply is locked out. A servo drive rectifies incoming AC into a DC bus, and that bus is smoothed by large capacitors operating at several hundred volts DC. Those capacitors do not discharge instantly when the supply is removed. They hold a dangerous voltage for a period the manufacturer specifies, commonly in the range of five to ten minutes.
The drive carries a label stating the discharge wait time and warning against opening the enclosure before it elapses. The failure mode is a worker who locks out the disconnect, then immediately opens the drive cabinet to work on power wiring, contacting a bus that is still at lethal voltage. The lock did its job at the disconnect. The capacitors are a separate, stored electrical hazard.
The control is straightforward and non-negotiable: after isolation, wait the full manufacturer-specified discharge time, then verify zero voltage on the DC bus with a properly rated meter before any contact. Verification with a meter, not the clock alone, is what confirms the discharge actually happened, because a failed bleed resistor can leave the bus charged past the rated time.
Robot cells in West Michigan auto-supply, plastics, and packaging plants are rarely just a robot. They include end-of-arm tooling, clamps, weld guns, and material-handling equipment, and those bring their own stored energy.
Pneumatic energy persists in cylinders, accumulators, and gripper tooling after the air supply is locked. A gripper holding a part by air pressure can keep holding, or release suddenly, when the residual pressure is finally bled. The procedure bleeds the system to zero, confirms zero on a gauge, and locks the supply valve. Pneumatic accumulators in particular store significant energy and have to be deliberately relieved.
Hydraulic energy in spot-weld guns and clamps behaves the same way, at higher pressures. A loaded hydraulic actuator can move with force when its pressure is relieved, so loaded actuators are restrained before the pressure comes off. Mechanical springs in tool changers, counterbalances, and the brakes themselves store energy that is released only in a controlled, restrained manner. None of these are touched by the electrical disconnect.
Isolation and stored-energy relief mean nothing until they are verified. Verification is the step that separates an energy-control procedure that protects people from a document that protects a binder. For a robot cell, verification covers each source identified in the cell-specific procedure:
Only when every applicable source reads zero is the cell at the zero-energy state OSHA 1910.147 requires. The try-to-start verification is the final confirmation that the isolation point selected actually controls the motion. A procedure that isolates the wrong disconnect passes every paper step and still leaves the robot live, which is exactly the kind of gap a try-to-start catches.
OSHA 1910.147 and ANSI/RIA R15.06 both require energy-control procedures that are specific to the equipment. A generic plant-wide LOTO procedure that says lock the disconnect does not satisfy the standard for a robot cell, because it does not identify the gravity loads, the pneumatic accumulators, the hydraulic weld gun, or the drive discharge time for that particular cell. Each robot cell has a different combination of stored-energy sources, and the procedure has to name them.
This is the most common deficiency we document in robotics safety audits: a strong general LOTO program with no cell-specific procedure for the residual and stored energy on the individual robot. The standards alignment behind this, across ANSI/RIA R15.06, ISO 10218, and OSHA 1910.147, is covered in detail in our standards alignment guide, and the procedure development itself is the core of our robot cell LOTO procedures service.
We will walk your robot cells, identify every stored and residual energy source, verify the discharge and restraint controls, and write cell-specific LOTO procedures that meet OSHA 1910.147 and ANSI/RIA R15.06. Direct line: 616-217-3325.
Request Gap AssessmentNo. Lockout isolates the electrical supply, but it does not by itself dissipate stored energy. A vertical axis held up by the servo brake can drop under gravity when the brake releases. Pneumatic and hydraulic accumulators stay pressurized. Spring-applied mechanisms stay loaded. And the DC bus capacitors inside the servo drive can hold a dangerous charge for minutes after disconnect. OSHA 1910.147(d)(5) requires all of this residual energy to be relieved, disconnected, restrained, or otherwise rendered safe before work begins.
Industrial robot axes are held in position by spring-applied, electrically released brakes. When power is present, the brakes are energized open and the servo motors hold position. When power is removed, the brakes set, which is the fail-safe design. But a heavy upper arm or a loaded end-of-arm tool on a vertical axis can still drift or drop if a brake is worn, if the brake is manually released for service, or if the load exceeds the brake holding torque. Gravity is the most underestimated stored-energy source on a robot cell.
The DC bus capacitors in a servo drive store energy at several hundred volts DC and can remain charged for several minutes after the supply is disconnected. Manufacturers specify a discharge time, commonly five to ten minutes, and label the drive accordingly. Opening a drive cabinet to work on power wiring before that discharge time has elapsed, and before verifying zero voltage with a meter, exposes the worker to a stored electrical hazard that the lockout did not remove.
Six common sources. Gravity on vertical and counterbalanced axes. Pneumatic pressure in cylinders, accumulators, and end-of-arm tooling. Hydraulic pressure in spot-weld guns, clamps, and balancers. Mechanical springs in brakes, counterbalances, and tool changers. Charged DC bus capacitors in servo drives and the power supply. And thermal energy in motors and resistors. A complete LOTO procedure for the cell must identify and address every source present, not just the main electrical disconnect.
Yes. ANSI/RIA R15.06 and ISO 10218 require the energy-control procedure for a robot system to account for all hazardous energy, including stored and residual energy, and they reference the same isolation and verification principles as OSHA 1910.147. The robot risk assessment must identify gravity loads, stored pneumatic and hydraulic energy, and the energy in the drive electronics, and the cell-specific procedure must specify how each is controlled before service.
Verification is the step that separates a real procedure from a paper one. After isolation, the authorized worker confirms each energy source is at zero: vertical axes blocked or supported, pneumatic and hydraulic systems bled to zero pressure with gauges confirming, accumulators relieved, brakes confirmed set or the axis mechanically restrained, and the servo drive DC bus measured below the safe threshold with a meter after the manufacturer discharge time. Try-to-start verification on the motion controls confirms the isolation. Only then is the cell safe to enter.
Related reading: Robot Cell LOTO: Aligning ANSI R15.06, ISO 10218, and OSHA 1910.147, Robotic Palletizer Lockout/Tagout, Robotics Safety Gap Analysis.