The Generator Auto-Start Lockout Before Service SOP

Purpose

A standby generator is designed to start without a person present. It cranks when the utility drops, it cranks on its exercise schedule, and a remote monitoring platform can start it from a phone. Every one of those can happen while a tech has a hand on the alternator fan, a wrench on the starter cable or a meter in the transfer switch. This SOP guarantees that no standby engine cranks and no transfer switch operates while anyone is working on either, and that the unit goes back to automatic protection when the work is done, with the customer told. It precedes every service visit, repair, inspection with covers off and load test. The engine's unexpected start is the stored-energy hazard 29 CFR 1910.147 governs for servicing; the transfer switch and charger circuits are electrical work under 29 CFR 1910.333, which is why this SOP isolates both. Every other generator card in this library that says "lock out per the SOP" means this one.

Scope

Covers: residential and light commercial standby generators with an automatic transfer switch, air-cooled or liquid-cooled, on natural gas or propane, for any work that puts a hand inside the enclosure or the transfer switch.

Does not cover:

• Fuel isolation. Closing the gas cock for a regulator or fuel line job is part of that job; a leak is handled under Fuel Leak Discovered, Response, and gas piping goes to a licensed gas fitter or plumber where the locality requires one.
• Portable generators, which have no auto-start. They are shut down at the unit and, for any work on the engine, the spark plug lead comes off.
• NFPA 110 Level 1 emergency systems in hospitals and similar occupancies, where the facility's own energy control program and impairment notice govern and this SOP is subordinate to them.

Roles and responsibilities

Procedure

1. Tell the customer and set expectations. Before touching the unit, tell the customer it will not protect the house while you work, give the expected time it will be off, and ask whether anyone at home depends on powered medical equipment. Note whether remote monitoring will alert the customer or the shop when the controller goes to off. Acceptance: customer acknowledged in person or by phone, time recorded on the ticket. Wrong looks like: a customer on home oxygen or a refrigerated medication who did not know; stop and reschedule the work for a time they can arrange backup, or keep the outage window short with them informed. Hazard: none at this step, it is a conversation at the door.

2. Set the controller to OFF. At the controller, select off, not manual and not auto. Off is the only mode in which the controller will not respond to a lost utility signal or to its exercise timer. Acceptance: the display or mode light shows off and no auto indicator is lit. Wrong looks like: a frozen screen, a mode that will not change, or a controller showing a fault and refusing input; do not trust the display, go straight to step 3, which removes the controller's power regardless of what it says. Hazard: until step 3 is done the engine can still start; stand to the side of the enclosure, away from the exhaust outlet and the cooling air louvers, while you are at the panel.

3. Remove the controller fuse, then disconnect the battery negative. Pull the controller fuse and keep it in your pocket. Then remove the negative battery cable first, and cover or tie the cable end so it cannot swing back onto the post. Acceptance: the display goes dark, and the cable end is secured clear of the terminal. Wrong looks like: the display stays lit after both are off, which means a second supply is powering the controller, usually the battery charger; stop, open the charger feed in step 4, and repeat this step. Hazard: a lead-acid battery vents hydrogen, so no flame or spark near it and eye protection on; removing negative first keeps a wrench that touches the frame from shorting the positive post.

4. Open, lock and tag the charger and enclosure supply. The battery charger and any enclosure heaters are fed from a utility branch circuit. Open that breaker at the panel or transfer switch, fit your personal lock and tag, and prove the charger terminals or receptacle dead with a tester proven on a known live source before and after, per NFPA 70E Article 120 (120.5 in the 2021 edition, renumbered in 2024), with work practices under 29 CFR 1910.333(b)(2) or 29 CFR 1926.417 on construction work. Acceptance: 0 V at the charger supply, tester proven on both sides of the reading. Wrong looks like: voltage still present, which means the wrong breaker or a mislabeled panel; stop, find the right breaker by test, re-lock, re-verify. Hazard: 120 V at the terminals until proven dead; treat them as live until the before-and-after reading is done.

5. Before work inside the transfer switch, isolate every source to it. This step only, and only a qualified electrical worker. Open the utility disconnect that feeds the transfer switch, open the generator main breaker, pull the utility sense fuses, and lock and tag each that takes a lock. Then measure line, load and generator lugs, each line to line, line to neutral and line to ground, with the tester proven before and after. Acceptance: 0 V at every point. Wrong looks like: any voltage at any point, a service where the only disconnect ahead of the switch is the utility meter, or a second source such as a solar inverter or a portable inlet; stop, do not open the switch, identify and isolate the source, or call the utility to pull the meter. Hazard: shock and arc flash at the line lugs until proven dead; wear the PPE the shop's risk assessment calls for through the verification itself.

6. Verify the engine will not start. Attempt a start from the controller and, where the unit has one, from the remote platform. Then check the stored hazards energy isolation does not remove: hold the back of a hand near, not on, the muffler and exhaust shield, and confirm the fan and flywheel are stopped. Acceptance: no click, no crank, no response; exhaust parts cool enough to work beside. Wrong looks like: any relay click or crank, or a muffler still hot from a recent run; stop, re-check steps 2 to 4, and let the exhaust cool before reaching past it. Hazard: this is the deliberate start attempt, so make it with hands and tools out of the enclosure; the muffler can burn skin well after shutdown.

7. Tag every isolation point and count them. Tag the controller, the battery cable, the charger breaker and every transfer switch isolation with your name, the date, a phone number and the reason. With more than one worker, each fits a personal lock on every point, and the last lock off is the last worker done. Acceptance: tags at each point, counted against the record, one lock per worker per lockable point. Wrong looks like: a point with no tag, or a second worker relying on the first worker's lock; stop work until each worker has locked on. Hazard: none new at this step; every energy source is already isolated.

8. Restore in reverse and prove the protective function. When the work is done, tools are out and every panel and guard is back on, remove your own locks and tags. Close the transfer switch cover first, then the utility disconnect, standing to the side of the panel as it closes. Where step 5 pulled them, refit the utility sense fuses before anything else changes on the generator: a controller that powers up in auto without utility sense sees an outage and starts and transfers on its own. Where step 5 opened it, close the generator main breaker. Then close the charger breaker, reconnect the battery negative, refit the controller fuse, and select auto. Acceptance: house on utility, controller in auto with no active fault, charger charging, displayed utility voltage present, and, where the work touched the engine, its controls or the transfer switch, a simulated outage per How to Run a Simulated Outage Test on a Service Visit that starts, transfers, retransfers and returns to auto. Wrong looks like: the unit cranks as auto is selected, or a fault that will not clear; set to off, find the cause, and do not leave the site with the controller in off without step 9's written notice. Hazard: re-energizing the switch and the battery is when a disturbed connection shows itself; stand clear of the battery and to the side of the transfer switch.

9. Tell the customer the unit is protecting them again. Confirm in person or by phone that the unit is back in auto, what was done, and when it next exercises. Where the site has remote monitoring, confirm the platform shows the unit online and ready. Acceptance: customer told, platform shows ready. Wrong looks like: the unit cannot return to auto; tell the customer in writing that it is not protecting the house, why, and when you will be back, and flag the ticket for the office. Hazard: none at this step.

The record this produces

A lockout block on the work order, completed on site:

• unit serial, time the controller went to off, time it returned to auto;
• each isolation point with its lock and tag, and who applied it;
• every zero-energy reading with the tester used and the known live source it was proven on;
• any step that failed, what was found, and what was done;
• customer notified at start and at finish, by whom and how.

The office reads it when the next tech is dispatched, the service manager reads it in a callback review, and it is the first document asked for if anyone is hurt.

Worked pass: a transfer switch repair with a mislabeled panel

Job: replace a failed transfer relay in the transfer switch of a 22 kW air-cooled unit. Tech and a licensed electrician on site.

Step 5 failed its acceptance. The electrician took the house-panel breaker labeled "Generator ATS", already locked at step 4, to be the switch's feed, pulled the sense fuses and opened the generator breaker. The line lugs still read 241 V line to line. The stop rule triggered: switch left closed, no hands in. Tracing showed the labeled breaker fed only the generator's charger circuit; the transfer switch was fed directly from the meter-main's service disconnect outside. That disconnect was opened, locked and tagged, and the line lugs re-read 0 V on every combination, tester proven before and after. Work began at 09:40 rather than 09:25.

Restore check. At step 8 the sense fuses went in before the controller fuse. The display came up showing utility at 240 V and the unit stayed quiet in auto. The panel label was corrected and the finding written on the ticket for the next visit.

References

• NFPA 70E, Standard for Electrical Safety in the Workplace, Article 120, current edition
• OSHA 29 CFR 1910.147 (the engine's unexpected start during servicing) and 29 CFR 1910.333 (electrical work practices); 29 CFR 1926.417 for construction work
• See related: Fuel Leak Discovered, Response
• The generator and transfer switch maker's service manuals