Learn Automation with MINATA #45: Machine Safety and the Emergency Stop — Not One Red Button
Machine Safety and the Emergency Stop: Not One Red Button
An emergency stop is one part of a risk-reduction system, not the single answer to every hazard. Where it goes, which stop category it triggers, how it is reset and how the circuit is built all have to come from the risk assessment of that particular machine — never copied from another machine because it was convenient.
An operational stop and an emergency stop are two different things
An operational stop halts the machine within the normal cycle, usually handled by the PLC in sequence. An emergency stop is a safety function: it must act independently, and more reliably, than the ordinary logic. Do not use the E-stop to shut down at the end of a shift in place of the Stop button, and do not use an ordinary Stop button in place of an E-stop.
Three stop categories
IEC 60204-1 distinguishes three stop categories, and the difference matters at design time:
| Category | How it stops | Used when |
|---|
| Stop category 0 | Energy removed from the actuator immediately | A controlled stop is unnecessary or would itself be unsafe |
| Stop category 1 | Controlled stop first, then energy removed | Safe deceleration is needed before disconnection |
| Stop category 2 | Controlled stop with energy retained | An operational stop; not a safety function |
Which category applies is an output of the risk assessment, tied to inertia, to loads that can fall, and to how a person could be hurt.
Circuit architecture, not just a button
The E-stop button has to act through a suitable safety architecture: a safety relay or safety PLC monitoring the loop, with positively guided contacts, usually dual channel so a single fault is detected. Do not simply wire the button to an ordinary PLC input and hope the software reacts in time — the required integrity calls for dedicated hardware matched to the assessed risk level, expressed as PL or SIL.
Reset is not a run command
Releasing the E-stop must never restart the machine. Releasing the button only clears the latch; a separate reset action confirms that the unsafe condition has been dealt with, and only a further separate Start command allows the machine to run. Keeping those three steps apart is what prevents unexpected motion while somebody is still in the danger zone.
A worked engineering situation
A station has E-stops at each point of access, a safety relay monitoring a dual-channel loop, and a Start command required separately after reset. When an E-stop is pressed, motion stops according to the category designed in; the ordinary PLC only reads the safety state in order to display it, and is not the protective layer.
The stop category, the PL or SIL level, the safety devices and the final layout all follow the risk assessment and the standards that apply to that machine.
Common mistakes
- Treating the E-stop as a bigger Stop button, used to shut down at the end of a shift.
- Wiring the E-stop to an ordinary PLC input with no safety architecture.
- Letting the machine restart when the E-stop is released, with no separate reset and Start.
- Choosing a stop category without a risk assessment behind it.
- Reusing a safety design copied from a machine with different risks.
Safety and E-stop checklist
- [ ] The operational stop and the emergency stop are clearly distinguished.
- [ ] The stop category (0, 1 or 2) was chosen from the risk assessment.
- [ ] The E-stop acts through a safety relay or safety PLC, with positively guided contacts and dual channel where required.
- [ ] Releasing the E-stop does not start anything; reset and Start are separate.
- [ ] The PL or SIL level and the safety devices follow the applicable standards.
Safety is a function that is designed, tested and documented — not a red button added at the end. #46 goes into safety relays and light curtains: protecting a hazardous zone by function.
Read more automation knowledge at MINATA: https://minatavn.com/en/blog/industrial-automation
Previous — #44: Modbus TCP over Ethernet: https://minatavn.com/en/blog/automation-44-modbus-tcp
Next — #46: Safety relays and light curtains: https://minatavn.com/en/blog/automation-46-safety-relays-light-curtains
View all MINATA technical articles