An emergency stop button, even when physically padlocked in the actuated position, does not satisfy the lockout/tagout (LOTO) requirement of 29 CFR 1910.147 for machine servicing or maintenance, because the e-stop is a control-circuit device, not an energy-isolating device that physically separates the machine from its energy source [S1][S5][S7].
The 2026 field record reinforces the point: OSHA's standard interpretation of 1910.147(f)(1) limits energised work to short testing or positioning windows, and a 23 April 2026 safety publication reiterates that "power buttons" and e-stops are not isolation points [S2][S6]. For practitioners, the rule is binary: isolate at the energy-isolating device, lock it, verify zero energy, then service.
How OSHA 1910.147 Defines the Two Devices
OSHA 1910.147(b) defines an "energy-isolating device" as a mechanical device that physically prevents the transmission or release of energy, including manually operated electrical circuit breakers, disconnect switches, line valves, blocks, and similar devices, and notes that a push button, selector switch, and other control circuit type devices are not energy-isolating devices [S1]. A control-circuit device only tells the machine to stop; the upstream disconnect, breaker, or valve still has the energy supply attached and re-energisable.
By contrast, an emergency stop button is defined under ISO 13850 and machinery safety standards as a fail-safe control device wired into the safety control circuit, designed to bring a hazardous motion to a stop as quickly as possible without creating additional hazards [S5]. The act of pressing an e-stop does not open the energy source; it opens the control loop, so a reset or a stuck contact can re-energise the machine at any time.
Why a Locked E-Stop Still Fails the Standard
Even when an emergency stop is padlocked in the depressed position, three 1910.147 requirements still fail. First, the energy-isolating device criterion is not met, because the upstream disconnect remains closed and energised. Second, the verification step required by 1910.147 App A, "try to start the machine by operating the normal starting controls," is defeated, since the locked button is the very control that was actuated. Third, the tagout attachment strength threshold of 50 pounds and the durable, standardised device criteria of 1910.147(c)(5) were written for energy-isolating devices, not control push buttons [S3][S4].
A 13 August 2026 incident write-up of a robotic cell makes the practical risk explicit: an authorised employee found a locked e-stop during a shift handoff and assumed the cell was in a LOTO state, allowing a second worker to enter the safeguarded space while energy was still present at the controller [S7]. The control relay released under a maintenance command, the cell re-energised, and the entrant suffered a crushing injury; the OSHA citation cited 1910.147(c)(4) for failure to isolate at an energy-isolating device.
Acceptable Alternatives When an E-Stop Is the Only Available Control
When a machine is built such that the only operator-accessible control is a push button or e-stop, OSHA's hierarchy is: (1) retrofit an approved energy-isolating device, (2) use a plug-lockout on a cord-connected machine at the receptacle, or (3) under 1910.147 App A, employ a tagout-only programme with the additional training and more rigorous periodic inspection required by 1910.147(c)(3) [S3]. OSHA does not list "lock the e-stop" as a permitted alternative, and an OSHA standard interpretation of 21 October 2024 explicitly declined to recognise ANSI B11.0-2020 and ANSI Z244.1-2016 "alternative methods" as a substitute for energy isolation [S2].
For partially de-energised work, 1910.147(f)(1) authorises a temporary removal of LOTO only when the task itself requires energisation, such as inching, jogging, or positioning, and only after the employer clears tools, removes employees from the danger area, removes the LOTO devices in sequence, performs the energised portion with effective safeguarding, then re-isolates and re-locks for the next service step [S2]. Outside that narrow window, a 22 April 2026 EHS publication cautions against using e-stops for routine lockout because the residual risk of inadvertent re-energisation is not reduced to the level the standard requires [S4][S6].
Engineering and Procurement Implications for Safety Circuits
Specifiers buying or upgrading machinery should require that every energy-isolating device be designed to accept a lockout device, per 1910.147(c)(2)(ii) for equipment installed or significantly repaired after 2 January 1990, and should require that e-stop circuits be wired through a dedicated safety relay or contactor that drops the energy-isolating device, not just the control circuit [S1][S4]. The e-stop button itself must comply with ISO 13850 (red mushroom on yellow background, positive opening, latching twist or key release), and any padlock cover on the button is, at most, a protection against unauthorised activation, not a LOTO device under 1910.147 [S5].
Practitioners also distinguish the emergency stop from related safety hardware: an emergency rescue plan governs what happens after an incident, while an emergency light governs egress visibility during power loss, and neither affects the isolation step required by 1910.147. In purchasing documents, "lockable e-stop" should be flagged as a red flag; the correct line item is a lockable disconnect or valve within line of sight of the operator, sized to the upstream short-circuit current or line pressure rating.
Decision Map: E-Stop vs LOTO in Three Questions
Three decision criteria separate an e-stop from a compliant LOTO installation. Criterion 1, energy separation: an e-stop opens the control circuit, while a LOTO device opens the energy-isolating device and physically blocks re-energisation. Criterion 2, verifiability: 1910.147 App A requires an authorised employee to attempt to start the machine after lockout, which is impossible if the locked control is the start circuit. Criterion 3, documentation and training: tagout use demands additional training and annual inspection rigour under 1910.147(c)(3), and no comparable programme applies to a padlocked button [S3][S4].
On a 1-to-3 conformance score (1 = fails, 2 = partial, 3 = full), a properly applied lock and tag at a disconnect scores 3 across all three criteria, a tagout programme at a non-lockable disconnect scores 2 to 3 depending on training depth, and a padlocked e-stop scores 1 across all three, regardless of padlock grade or cover type [S1][S3][S5]. A useful related comparator for safety-hardware spend, where lockout padlocks and tagout kits are typically line-itemed alongside personal protective equipment budgets, is that LOTO penalties in the OSHA penalty schedule can reach $161,323 per repeat violation as of the 2026 inflation adjustment, dwarfing the cost of a proper disconnect retrofit [S4].
What Good Practice Looks Like on a Real Line
A compliant procedure on a packaging line, a stamping press, or a robotic cell follows six sequential steps drawn directly from 1910.147 App A: notify affected employees; identify the type and magnitude of energy; shut the machine down by its normal stopping procedure, which may include the e-stop; deactivate the energy-isolating device, typically a disconnect switch, motor contactor, or ball valve; apply the assigned individual lock and tag; and dissipate stored energy in capacitors, springs, hydraulic accumulators, or pneumatic receivers before the verify-start step [S3]. The e-stop in that sequence is the third step, not the fifth; once the disconnect is open and locked, the e-stop status is irrelevant to the lockout state.
Two trackable signals confirm the rule is being followed on a given site. First, every authorised employee's lock is keyed individually (no master key that defeats the group-lockout requirement of 1910.147(f)(3)), and a group lockout box is used when more than one employee is on the equipment [S1]. Second, the periodic inspection required by 1910.147(c)(6) is documented annually for each energy control procedure, with the inspector reviewing the procedure while an authorised employee demonstrates it, and the tagout-only procedures reviewed with the higher rigour called out in 1910.147(c)(3) [S3][S4].
On 21 September 2026, the practical guidance from OSHA, from the 23 April 2026 safety press, and from the 13 August 2026 incident write-up converges: an e-stop is a safeguard, not a LOTO device, and any procedure that treats a locked button as lockout will fail an OSHA inspection and, more importantly, will fail the worker who relies on it. The next verifiable check for any facility is the engineering review of every machine on the floor: does each one have a lockable energy-isolating device within line of sight, and is the e-stop wired to drop that device, not just the control loop?