July 8, 2026 · Robot Cell LOTO
Walk up to a robot cell mid-service in a West Michigan plant and you will often find three or four trades in and around it at once: a controls tech at the drive cabinet, a mechanical tech on the tooling, a weld tech at the gun, and an operator staging parts. Now count the energy-isolating devices. The robot controller has a disconnect. The weld power has its own. The conveyor, the part presenter, and the dust collector may each have theirs. That is a lot of locks and a lot of people, and it is exactly the situation OSHA's group lockout provision exists for.
This is the engineer's walkthrough of group lockout for a multi-source robot cell: why the cell has more energy than the main breaker suggests, how the group lock box actually protects a crew, what the primary authorized employee is responsible for, where stored energy hides after the disconnect is open, and the specific gaps we document when a senior controls and EHS engineer audits these procedures. It builds on the standards stack in our ANSI, ISO, and OSHA alignment guide and the residual-energy detail in our stored energy in servo drives guide.
The first failure of a weak robot-cell lockout is scope. Someone locks the robot controller disconnect, calls the cell dead, and goes in. But an integrated robot cell is a system of machines, and the robot's own disconnect isolates the robot, not the cell. A proper energy-control procedure inventories every source, and on a typical weld or assembly cell that list is long.
| Energy source | Where it lives in the cell | How it is controlled |
|---|---|---|
| Electrical, primary | Robot controller, weld power, conveyors, ancillaries | Lock each disconnect open, verify zero voltage |
| Electrical, stored | Servo drive DC bus capacitance | Allow bleed-down time, verify before contact |
| Pneumatic | Clamps, grippers, tool changers, air blow-off | Lockable dump valve, bleed the line, verify zero pressure |
| Hydraulic | Heavy clamping, some presses and positioners | Isolate, relieve accumulator pressure, verify |
| Gravity | Vertical robot axes, counterweights, raised tooling | Block, pin, or support before entry; brakes are not isolation |
| Stored mechanical | Springs, tensioners, air receivers, accumulators | Relieve or restrain per the equipment procedure |
Every source on that list needs its own isolation, and several need verification that goes beyond flipping a disconnect. A vertical robot axis held only by its servo brakes is not isolated. The brake is a control device, not an energy-isolating device, and a released or failed brake drops the arm. The axis has to be blocked, pinned, or supported. Servo drive capacitors hold a lethal charge after the disconnect opens and need bleed-down time. Air lines have to be dumped and verified at zero. This is the multi-source reality that makes a single padlock inadequate and group coordination necessary.
OSHA 1910.147 is built around personal lockout: each authorized employee applies their own lock to each energy-isolating device and holds the only key. That is clean when one person services one machine with one disconnect. It falls apart on a robot cell with six disconnects and four workers, because you would need every worker to apply a lock to every device. Two dozen locks on the cell, chaos at shift change, and pressure to shortcut the very isolation that keeps people alive.
The group lockout provision solves that without weakening protection. OSHA 1910.147(f)(3) allows a group procedure as long as it affords each employee protection equivalent to their own personal lock. The mechanism that delivers that equivalence is the group lock box, and the person who makes it work is the primary authorized employee.
The group lock box is elegant in its simplicity. Here is the sequence on a robot cell.
The whole cell's isolation is captured behind one box, and each worker still holds personal, exclusive control of their own protection through a single lock they own. That is the equivalence OSHA requires, achieved with a workable number of locks. The OSHA lockout/tagout eTool lays out the group procedure requirements in detail.
Group lockout does not happen on its own. OSHA vests primary responsibility for a group in a single authorized employee, and on a robot cell that role is substantial. The primary authorized employee determines the exposure the crew faces, ensures every energy-isolating device on the cell is locked out before work begins, controls the group lock box, and accounts for every worker before energy is restored. On a large cell, or across a shift change, that coordination is the difference between an isolation that holds and one that gets a source re-energized with someone still inside.
Two points we stress on audits. First, the primary authorized employee role has to be named and trained, not assumed. Second, it does not dilute personal protection. Every worker still applies and controls their own lock on the box. The primary authorized employee organizes the isolation; the personal lock is what actually protects the individual. Both have to be present.
The most dangerous moment in a multi-shift service job is the handoff. If the group lock box empties out at the end of a shift because everyone removes their lock and goes home, the isolation is gone, and the incoming crew has to re-establish it from scratch or, worse, assumes it carried over. OSHA and ANSI/RIA R15.06 both expect continuity of protection across changes of personnel and shift. The workable methods, an orderly transfer of the primary authorized employee role and the box between shifts, or a documented shift-transfer procedure, have to be written into the cell's energy-control procedure, not improvised at 11 p.m. We see this gap constantly, and it is a citation and an injury exposure at the same time.
One more line has to stay bright. The safety scanners and light curtains that protect operators during production do not isolate energy and have no role in group lockout. They can be muted or bypassed for maintenance, and they never touch the electrical, pneumatic, hydraulic, or stored energy in the cell. Servicing a robot cell requires energy isolation under OSHA 1910.147, and when a crew does it, that isolation is group lockout. In Michigan, MIOSHA Part 85 enforces the requirement regardless of how sophisticated the safeguarding is. The distinction between safeguarding and isolation is the backbone of our robotic weld cell LOTO guide as well.
Five patterns account for most of the group-lockout findings we document across West Michigan robot cells.
The robot disconnect is locked, but weld power, a conveyor, or an ancillary source is missed. The fix is a cell-specific procedure that inventories and isolates every energy-isolating device, verified on the floor.
Gravity axes left on their brakes, drive capacitors not bled down, air not dumped. The fix is blocking or supporting loaded axes, verified bleed-down, and zero-energy verification before any contact.
A group in the cell with no one vested in coordinating the isolation. The fix is a named, trained primary authorized employee written into the procedure.
The primary authorized employee locks out and the crew enters trusting them, with no personal locks on the box. The fix is a personal lock per worker on the group lock box, no exceptions.
Protection lapses at shift change. The fix is a documented continuity procedure that transfers the box and the primary role without ever leaving the cell without its isolation locks in place.
We will inventory every energy source in your robot cells, write cell-specific group lockout procedures to OSHA 1910.147(f)(3) and MIOSHA Part 85, define the primary authorized employee role and group lock box method, address stored and residual energy, and build the shift-transfer continuity your multi-source cells need.
Request Gap AssessmentGroup lockout is the procedure used when a crew, not a single person, services a robot cell. Under OSHA 1910.147(f)(3), the group must be protected to a level equivalent to each person applying their own personal lock to every energy-isolating device. In practice a primary authorized employee isolates and locks all the cell's energy sources, secures the keys in a group lock box, and every authorized employee then applies a personal lock to that box before entering.
Because a robot cell usually has multiple energy-isolating devices and multiple people servicing it. A controls tech, a mechanical tech, a weld tech, and an operator may all be in the cell at once, and the cell may have separate disconnects for the robot, weld power, conveyors, and ancillary equipment. Group lockout coordinates all of that so no source is missed and no worker's protection depends on someone else remembering they are inside.
More than most cells account for. Electrical at the main disconnect and within servo drives, pneumatic for clamps and tooling, sometimes hydraulic, and stored or residual energy that outlives the disconnect: gravity on vertical robot axes and tooling, spring pressure, capacitance in servo drive buses, and pressure in air receivers and accumulators. A group lockout procedure has to identify and control every one of them, not just the main breaker.
The primary authorized employee is the single person OSHA 1910.147(f)(3) makes responsible for coordinating the group lockout. They verify the equipment served, ensure every energy-isolating device is locked out, control the group lock box and keys, and account for the crew. Vesting that coordination in one named person is what keeps a multi-source, multi-worker isolation from falling through the cracks. It does not replace each worker's personal lock; it organizes the whole isolation.
The primary authorized employee locks out each energy-isolating device on the cell, then places the keys to those locks inside a group lock box and locks the box. Each authorized employee affixes their own personal lock to the box when they begin work and removes it when they finish. Because the box cannot open until the last personal lock comes off, no energy source can be restored while anyone is still working in the cell. It gives a crew personal-lock-level protection with a workable number of locks.
No. Presence sensing, light curtains, and safety scanners protect people during production, when the cell is running. They do not isolate energy and can be muted or bypassed for maintenance. Servicing a robot cell still requires energy isolation under OSHA 1910.147, and when a crew does that work, it requires group lockout. Safeguarding and lockout solve different problems, and MIOSHA Part 85 enforces the lockout requirement in Michigan regardless of how good the sensing is.
Related reading: Robot Cell LOTO Standards Alignment, Stored and Residual Energy in Robot Servo Drives, Robotic Weld Cell Lockout/Tagout.