How to Do a Safe Shutdown of a System You're Working On

Why this matters

The moment you put a hand, a tool, or a meter probe inside a running system, the thing that hurts you is the energy source you forgot about. Most field injuries are not from the source you shut off. They are from the one you did not know was there: a second feed, a charged capacitor, trapped pressure, a spring under load. This is the pre-work shutdown you do so you can safely work and then restore the system the same visit. It is different from leaving a system shut down because you cannot fix it (see the related temporary safe-shutdown method). The rule that keeps you whole: a control switch is not isolation. Isolate at the source, bleed the stored energy, and verify dead before you commit.

Step 1: List every energy source before you touch anything

Stand back and name what could move, shock, burn, or release. Do not skip this because the job "looks simple."

• Electrical - the primary supply, plus any second feed, control transformer, battery, or backup that can backfeed the circuit.
• Gas or fuel - the supply line and anything that can leak or ignite.
• Pressure - water, hydraulic, refrigerant, air, or steam held in the system.
• Stored mechanical or thermal - a charged capacitor, a loaded spring, a raised or suspended load, a flywheel still spinning, hot metal or hot fluid.

Write the list in your head or on the job note. A source you never named is a source you will never isolate.

Step 2: Stop the equipment through its normal control first

Bring the system to a stop the way the operator would: the off switch, the thermostat, the stop button. This is not your isolation, it is just getting it to rest so nothing is running when you pull the disconnect. Never treat this control as your safety barrier. A thermostat can call again, a switch can fail closed, a timer can restart it.

Step 3: Isolate each source at the source

Safety lead: de-energize and secure each supply before anything else. Open the electrical disconnect. Close and secure the gas or fluid supply valve. Do this at the physical isolation point, not at a downstream control. If the equipment has more than one feed, isolate every one. A single-point shutoff on a two-feed system leaves half of it live.

Step 4: Bleed and discharge stored energy

Safety lead: relieve what is stored before you open anything. Removing the supply does not empty the system.

• Pressure - open the bleed or relief point and bring the reading to zero on the system's own gauge. Trapped pressure does not care that the supply is closed.
• Electrical storage - allow capacitors to discharge and confirm, following the equipment's discharge method. A disconnected capacitor can still hold a shock.
• Mechanical - lower or physically block any raised or spring-loaded part so it cannot drop or snap.
• Thermal - let hot surfaces and fluids cool to a safe touch before you reach in.

Step 5: Verify dead, zero, and cold

Verification is a separate step from isolation. Assume nothing.

• Electrical: meter it. Use live-dead-live: prove your tester works on a known live source, test the circuit you isolated and read zero, then prove the tester still works. That confirms a dead reading is real and not a dead meter.
• Pressure: read zero on the gauge or test point, not on the handle position.
• Water plus electricity together: treat both as live until each is separately verified. This pairing is the one that kills.

If you cannot verify a source is safe, you are not ready to work.

Step 6: Secure it against restart

A shutdown anyone can undo is not safe while your hands are inside.

• Where a lockout point exists, lock the disconnect or valve in the safe position and tag it with who, when, and why.
• Where you cannot lock it, make a restart obviously wrong: remove a handle, cap a fitting, hang a clear tag, and keep the person who might flip it in sight or informed.
• On a multi-tech job, everyone who works on it applies their own lock or tag. One person's lock does not clear another person's hazard.

Step 7: Work, then restore in reverse

Only now do you open the system and work. When the repair is done, restore in the reverse order: remove locks, re-pressurize, then re-energize last, watching the first startup. Bringing a system back up is its own procedure with its own risks (see the related startup method). The discipline to bank: isolate at the source, bleed the stored energy, verify dead, secure it, then work.

References

• OSHA 29 CFR 1910.147 (The Control of Hazardous Energy, lockout/tagout)
• OSHA 29 CFR 1910.333 (selection and use of electrical work practices, verify de-energized)
• NFPA 70E (electrical safety in the workplace, test-before-touch)
• See related: The Temporary Safe-Shutdown Method, and How to Do a Proper Equipment Startup After Service