7.4 Equipment Emergency Shutoff & Emergency Stop Procedures
Key Takeaways
- An emergency stop is a control-circuit device that halts hazardous motion; OSHA 29 CFR 1910.147(b) states explicitly that push buttons, selector switches, and other control-circuit devices are NOT energy-isolating devices and never substitute for lockout/tagout.
- NFPA 79 / IEC 60204-1 recognize Stop Category 0 (immediate removal of power, uncontrolled stop) and Category 1 (controlled stop then power removal) as emergency stop functions; Category 2 leaves power available and is a normal production stop, not an emergency stop.
- ISO 13850 and NFPA 79 require a red actuator on a yellow background, a self-latching action, and a deliberate manual reset that restores only the ability to start — reset must never restart the machine by itself.
- Supervisors must know facility-level shutoffs as well as machine E-stops: main electrical disconnects and EPOs, fuel-gas emergency valves, fuel-dispensing shutoffs installed 20 to 100 feet from dispensers (NFPA 30A), compressed air and steam block valves, ESD systems, and conveyor pull-cords (ANSI B20.1).
- Emergency shutoff devices must be visually checked pre-shift, function-tested on a documented schedule, and taken out of service on failure; after any emergency shutdown, restart is authorized only once the cause is identified and corrected — never to reproduce the fault.
Equipment Emergency Shutoff & Emergency Stop Systems
When BCSP revalidated the Safety Trained Supervisor examination in 2025, Domain 5 was deliberately widened: it shifted away from the former narrow focus on fire safety to include emergency equipment and emergency shutoff procedures. That change reflects field reality. When a conveyor drags a sleeve toward a pinch point, a press cycles unexpectedly, a hydraulic hose whips, or a mobile machine strikes a buried gas service, the supervisor's fastest available control is not a permit, a plan, or a phone call — it is a shutoff device that somebody already knows how to reach. Seconds determine injury severity, and the decision is almost always made by the nearest worker, not by the safety department.
1. Emergency Stop vs. Energy Isolation: The Distinction That Decides Exam Items
An emergency stop (E-stop) is a control-circuit device. It commands the machine's control system to remove or interrupt motive power so that hazardous motion halts as quickly as the machinery safely allows. An energy-isolating device is a mechanical device that physically prevents the transmission or release of energy — a disconnect switch, circuit breaker, line valve, blind flange, or block.
OSHA settles the relationship explicitly in the definitions at 29 CFR 1910.147(b): push buttons, selector switches, and other control-circuit-type devices are not energy-isolating devices. Chapter 5.1 teaches this from the lockout side; the emergency-response side is the mirror image of the same rule.
| Attribute | Emergency Stop (E-Stop) | Energy-Isolating Device (LOTO) |
|---|---|---|
| Device type | Control circuit (electronic command) | Mechanical (physical break in the energy path) |
| Primary purpose | Halt hazardous motion right now, by anyone, without training prerequisites | Make the machine safe to service, by an authorized employee |
| Who may operate it | Any worker who perceives the hazard | Authorized employees only |
| Can it be locked? | No — it cannot accept a lock in the OSHA sense | Yes — that is its defining requirement |
| Protects a person working inside the machine? | No. Stored energy and control faults remain | Yes, once stored energy is dissipated and verified |
| Correct use | Emergencies and imminent-danger interventions only | Any servicing or maintenance exposing an employee to hazardous energy |
Exam trap: A distractor will present a maintenance worker who "hit the E-stop and reached into the die." That is the wrong answer every time. An E-stop buys time; it never authorizes entry. If any part of the body will enter a point of operation or danger zone, the E-stop is followed by the full six-step LOTO sequence from Section 5.1.
2. Stop Categories Under NFPA 79 / IEC 60204-1
Machine builders classify stop functions into three categories. Supervisors are expected to know that only the first two qualify as emergency stops.
| Category | Behavior | Typical Application |
|---|---|---|
| Category 0 | Immediate removal of power to the machine actuators — an uncontrolled stop. Motion coasts or is arrested by mechanical brakes. | Small machines, saws, grinders, most conveyors |
| Category 1 | Controlled stop: power remains available to the actuators long enough to bring the motion to a stop, then power is removed. | Large rotating masses, robots, high-inertia drives where a Category 0 stop would itself create a hazard (dropped load, spilled melt, uncontrolled robot arm) |
| Category 2 | Controlled stop with power left available to the actuators. | Normal production stop — not an emergency stop function |
STOP FUNCTION SELECTION LOGIC
[Does stopping instantly create a NEW hazard?]
│ │
NO YES
│ │
▼ ▼
[ CATEGORY 0 STOP ] [ CATEGORY 1 STOP ]
Power cut immediately Controlled decel, then power cut
│ │
└──────────┬──────────┘
▼
[ MANUAL RESET REQUIRED ]
Reset restores the ability to start —
it must NEVER restart the machine
3. Emergency Stop Device Design, Identification & Access
ISO 13850 and NFPA 79 establish the recognizable conventions supervisors are expected to verify during walkthroughs:
- Color coding: The actuator is red; where a background exists immediately around the actuator, that background is yellow. No other machine control uses this combination.
- Latching action: The device self-latches in the actuated position and requires a deliberate manual reset. Resetting only restores the ability to start; it must not, by itself, restart the machine.
- Actuator styles: Palm/mushroom-head pushbutton, pull-cord (cable-pull) along conveyors, foot-operated trip bar, or ropes on continuous processes. Cable-pull devices must sense both pulling and cable slack/breakage.
- Unobstructed access: Devices must be reachable from every operator position and along walking routes beside continuous equipment. Blocking an E-stop with stock, pallets, carts, or a rolling toolbox is a supervisor-correctable violation on sight.
- Legibility: Painted-over, faded, unlabeled, or vandal-taped devices must be tagged out of service and repaired.
Specific OSHA requirements reinforce these conventions. 29 CFR 1910.217(b)(7)(v) requires mechanical power presses to have a red stop control whose momentary operation immediately deactivates the clutch and applies the brake. 29 CFR 1926.555(a)(1) requires a means for stopping the motor or engine at the conveyor operator's station, with an audible warning sounded before start-up, and 1926.555(a)(2) extends that requirement to a remote motor location.
4. Facility and Process-Level Emergency Shutoffs
Machine E-stops are only the first tier. Supervisors must also be able to locate and describe the utility- and process-level shutoffs serving their area.
| Shutoff Type | What It Isolates | Supervisor Knowledge Expectation |
|---|---|---|
| Main electrical disconnect / EPO | Feeder power to a machine, cell, or room | Location, labeling, arc-flash PPE boundary, who is qualified to operate it |
| Fuel-gas emergency shutoff valve | Natural gas or LPG service to a building or process | Location outside the hazard, quarter-turn direction, never re-open without the gas utility |
| Fuel-dispensing emergency shutoff | Power to fuel dispensers (NFPA 30A) | Installed not less than 20 ft and not more than 100 ft from the dispensers; must be clearly identified |
| Compressed air / steam block valve | Pneumatic and thermal energy to a line | Location upstream of the work; bleed-down point downstream |
| Emergency Shutdown (ESD) system | An entire process train in chemical, refining, and gas facilities | Which ESD level applies, who has authority to initiate, expected consequences of a trip |
| Conveyor pull-cord (ANSI B20.1) | Belt/roller drive along the full run | Cord tension, both-direction actuation, manual reset only |
| Crane / hoist mainline disconnect | Bridge, trolley, and hoist power | Location on the runway or at the pendant; used when a load must be left suspended and secured |
| Emergency shower/eyewash and spill kits | (Response equipment, not isolation) | Covered in Section 7.3 — verified on the same routine inspection round |
Field standard: Every worker in the area should be able to walk to the machine E-stop and to the area disconnect without hesitation, in the dark, wearing gloves. If a new hire cannot do this on day one, the orientation from Section 1.2 was incomplete.
5. Routine Verification of Emergency Shutoff Devices
Domain 5 pairs emergency shutoff procedures with routine emergency equipment inspections for a reason: an emergency device that has never been function-tested is an assumption, not a control.
- Pre-shift visual check. Fold this into the startup sweep from Section 2.1 — actuator present, undamaged, unobstructed, legibly labeled, background intact.
- Periodic function test. Physically actuate the device on the manufacturer's schedule (commonly monthly for machine E-stops and pull-cords) and confirm that motion actually stops within the expected distance/time, then confirm the reset behaves correctly.
- Documented results. Record device ID, date, tester, pass/fail, and corrective action — the same evidentiary rigor demanded for inspections in Section 2.1.
- Out-of-service control. A failed emergency stop is an imminent-danger condition for that machine. Remove the machine from service, do not "run it carefully until the part arrives," and escalate through the closed-loop tracking process in Section 2.2.
- Post-modification retest. Any control-system change, PLC update, guard rework, or drive replacement invalidates the previous test. Retest before release to production.
6. The Supervisor's Post-Shutdown Sequence
Hitting the shutoff is the beginning of the response, not the end of it. The sequence below is the one exam scenarios reward.
[1] STOP ── Actuate the nearest emergency shutoff. Anyone. No permission needed.
│
[2] SECURE ── Keep people out. Establish a boundary. Account for personnel.
│ Render medical aid; activate the EAP if the event escalates.
│
[3] ASSESS ── Identify the energy still present: stored pneumatic/hydraulic
│ pressure, suspended loads, springs, thermal mass, capacitors.
│
[4] ISOLATE ── If anyone will enter the danger zone, apply full LOTO.
│ The E-stop does NOT substitute for it.
│
[5] REPORT ── Notify management; preserve the scene for investigation
│ (Section 1.3). Photograph positions before anything moves.
│
[6] RESTART ── ONLY after the cause is identified, the corrective action is
verified, and a designated authorized person clears the restart.
Never restart to reproduce the fault. "We restarted it to see if it would do it again" is one of the most common contributing factors in secondary-injury investigations. Likewise, never use an emergency stop as a routine on/off control: Category 0 stops impose mechanical shock on drivetrains and brakes, and habitual use both wears the device and destroys its psychological signal value.
A millwright reports that a packaging machine keeps jamming. He palms the red emergency stop mushroom button, confirms all motion has ceased, and begins reaching between the sealing jaws to clear the jammed carton. The supervisor observes this from across the aisle. What is the correct supervisory determination?
A 12,000-pound rotating flywheel press and a small benchtop drill press are being specified for a new work cell. The controls engineer asks which emergency stop category applies to each machine. What is the correct pairing and rationale?
During a startup sweep, a supervisor finds that a conveyor pull-cord has been zip-tied to a handrail so it stays taut, a pallet of stock is stacked against the line-side emergency stop station, and the E-stop function test log for that line has no entry in five months. Which combination of actions best reflects the supervisor's obligations?