Machine Design #35: Recovery After an E-stop — Reset Must Not Restart the Machine

Pressing an emergency-stop device is only the beginning of a safety event. The part that is often underestimated is how the machine will recover afterward.

If releasing the E-stop immediately resumes the cycle, motion may begin while the workpiece is displaced, a person remains inside the hazardous area, or the software state no longer matches the mechanism. At the other extreme, blindly homing every axis after every stop can create another hazard, damage a partially processed part, or release a suspended load.

A sound recovery design separates seven events:

Activation of the emergency stop.
Achievement of the intended stopped state.
Inspection of the cause and affected zone.
Reset of the safety function.
Reconciliation of physical and control states.
A separate, intentional restart command.
Controlled recovery of the interrupted process.

This article presents a conceptual engineering framework. It does not replace a risk assessment, applicable type-C standards, local regulations, validation of safety functions, or review by a competent machine-safety professional.

1. An E-stop is a complementary protective measure, not a universal safety switch

ISO 13850 defines principles for designing an emergency-stop function regardless of the energy technology used. The function helps avert or reduce an emerging hazard, but it does not replace inherently safe design, guards and interlocks, protective stops, safe speed or position functions, energy isolation for maintenance, or safe operating procedures.

If a hazard remains after motion stops, adding another red mushroom button does not address the source of the risk. An E-stop should also not become the normal way to stop every cycle. Routine use can hide inadequate mode control and weaken the distinction between normal stopping and a real emergency.

2. Separate emergency stop, protective stop, and energy isolation

Emergency stop

A person activates it to avert or reduce a hazard that is occurring or about to occur.

Protective stop

A protective device or protective condition initiates it—for example, opening an interlocked guard or entering a monitored area.

Energy isolation

Energy sources are isolated and stored energy is controlled so that human intervention can be performed safely, especially during maintenance.

All three may stop visible motion, but their purpose and required integrity are different. An E-stop device is not automatically an energy-isolating device. Whenever a person must enter a hazardous area to clear a jam or repair equipment, determine whether an isolation and lockout/tagout procedure is required.

3. Define “stopped” in terms of the hazard

Removing motor power does not remove every hazard. A vertical axis may fall under gravity; a flywheel may coast; a cylinder may drift through leakage; a spring may remain compressed; an accumulator or pipe may stay pressurized; process material may remain hot; a robot brake may hold a suspended load; and loss of vacuum may drop a workpiece.

The risk assessment therefore needs an intended state for every relevant energy source. Depending on the mechanism, energy may need to be removed, reduced in a controlled way, retained, mechanically blocked, vented, or monitored.

There is no universal rule that “de-energized equals safe.” For a mechanism carrying a load overhead, uncontrolled loss of energy may be the event that creates the hazard.

4. Draw the energy map before writing the recovery sequence

List electrical power and control power, pneumatics, hydraulics, vacuum, gravity, springs and elasticity, heat, process pressure, kinetic energy, and energy arriving from linked equipment.

For each source, answer:

Where does the energy go when the E-stop is activated?
How long does it take to reach the required state?
Is feedback available to confirm that state?
Which energy is intentionally retained, and why?
What are the failure modes of valves, brakes, contactors, and mechanical locks?
Can a person gain access before the hazard has ended?

The map must also include energy supplied by another machine, a shared conveyor, or common utilities. A local stop is incomplete if an adjacent station can still push material into the zone.

5. A conceptual state machine for recovery

RUNNING

The machine operates in an authorized mode.

EMERGENCY_STOP_ACTIVE

An E-stop has been activated and the safety function executes its designed reaction.

STOPPED_NOT_READY

Hazardous motion has stopped, but the device remains latched, the cause has not been resolved, the zone has not been checked, or stored energy and mechanism state are not yet acceptable.

RESET_ALLOWED

Every condition required to accept a safety reset has been met.

RESET_COMPLETE_NOT_READY

The safety function is reset, but operation is still prohibited. Drives may not be enabled, reference positions may be unknown, the workpiece may need inspection, or the selected recipe and mode may be inconsistent.

READY_FOR_RESTART

Safety and operating permissives have been satisfied. The machine waits for a separate start command.

RECOVERY_MODE

Only limited recovery actions are available, such as controlled jogging, retracting an actuator, unloading a part, or re-establishing a reference according to the risk assessment.

RUNNING

The system returns to production only after an intentional command and confirmation of all required conditions.

This is a reasoning model, not a safety-program template. The real architecture must meet the standards and required performance level for the machine.

6. Releasing the E-stop, resetting, and restarting are three different actions

Release the actuator

The operator unlatches the E-stop device after the initiating cause has been addressed.

Reset

The safety control function regains the ability to prepare the system for operation.

Restart

A separate and intentional command requests the machine to begin or resume motion.

The design must prevent release of the button from starting motion, reset of a safety relay or safety PLC from moving an actuator, restoration of power from resuming the cycle, and guard closure from causing an unassessed automatic start.

A reset must not create a hazard. It changes the logical status from “inhibited by a safety event” to “eligible for preparation,” not directly to “run.”

7. Place reset controls where the relevant hazardous zone can be checked

Reset location is a risk-assessment decision, not a wiring convenience. Can the person resetting the system see the entire affected area? Are there blind spots? Could somebody remain trapped inside a guard? Are separate reset points needed for different zones? Does the application need trapped keys, an enabling device, or a search procedure? Is remote HMI reset justified?

For a large cell or a zone that can contain several people, the design may need measures preventing restart while somebody remains inside. The selected measure must follow the applicable standards and risk assessment.

8. Restart interlocks and operating permissives

After safety reset, the control system commonly checks guard and interlock status, the E-stop chain, utility pressure, drive readiness, brake feedback, allowable axis positions, clamp and workpiece state, recipe and operating mode, and unresolved critical alarms.

Keep three classes distinct:

Safety condition: part of a safety function and implemented with the required safety integrity.
Process permissive: an operating or quality condition required for the intended cycle.
Diagnostic: information that helps identify and resolve a fault.

Do not put every ordinary sensor into the safety chain. Equally, do not use a standard process PLC as a substitute for a safety function required by the risk assessment.

9. Software state may be wrong after an E-stop

An emergency stop can interrupt clamp closing, robot handoff, pressing, adhesive dispensing, machining, or pallet transfer. A sequence bit saying “Step 42” does not prove that the mechanics still correspond to Step 42.

During the stop, a cylinder may drift, a part may fall or shift, a sensor may change, a drive may lose its reference, a timer or counter may reset, and auxiliary equipment may finish an action independently. Recovery must verify physical state rather than continue from the previous step number by assumption.

10. Design state reconciliation

After reset, collect evidence about axis position, clamp state, workpiece presence and seating, tool position, doors and guards, pressure and vacuum, recipe and part identity, and the state of linked equipment.

Classify the result:

Known safe state: the system can proceed toward ready through a defined sequence.
Known recoverable state: a limited recovery mode is required.
Unknown state: automatic operation is prohibited until inspection or controlled referencing.
Faulted state: maintenance or another defined intervention is required.

Never infer mechanical state only from the last command issued. A command is intent; feedback is evidence.

11. Homing after an E-stop is not automatically safe

A homing move may cross a workpiece, pull cables or hoses, drop a load, drive into a hard stop, or collide a robot with a jig. Before homing, determine whether absolute position remains trustworthy, whether the motion envelope is clear, whether a part or clamp blocks the route, whether axes must home individually, which order minimizes risk, and whether limited speed, hold-to-run control, or an enabling device is required.

One universal “home all” command is rarely suitable for every abnormal state.

12. Recovery mode needs explicit authority and limits

Recovery mode may allow limited-speed jogging, actuator retraction, part release, material purging, or datum recovery. It needs clear mode selection, authorized access, only the necessary actuators enabled, appropriate limits on speed, force and travel, and HMI guidance describing the intended action and prerequisites.

Where required by the risk assessment, motion should use hold-to-run control or an enabling device. Leaving recovery mode must trigger another consistency check. Recovery must never become a permanent bypass used to keep production running.

13. Treat vertical mechanisms and suspended loads separately

Check whether the brake holds on power loss, whether brake feedback and periodic proof testing exist, whether a pneumatic cylinder has a suitable lock valve or rod lock, how quickly leakage causes drift, and how gravitational energy is mechanically secured for maintenance.

The enable sequence must prevent a brake from releasing before the motor produces holding torque. A conceptual sequence is: drive ready; holding torque established; brake released in the validated order; position feedback confirmed. Product-specific requirements and validation remain decisive.

14. Decide what happens to clamps and workpieces

For every clamp, ask whether it should hold or release during an emergency stop, whether loss of air can drop the workpiece, whether continued clamping can trap a person, whether a partially processed part can be recovered, and whether stored clamp energy must be vented before intervention.

Possible measures include check valves, mechanical locks, dump valves, pressure feedback, controlled release, and a catch tray. Compare the hazards of both holding and releasing; do not rely on the habit that “fail-safe means return when air is lost.”

15. Define reset ownership for multiple zones

In a multi-zone line, document which E-stop affects which scope, how upstream and downstream zones react, who confirms each area is clear, whether a local reset makes another zone ready, and who owns shared equipment such as conveyors, robots, and transfers.

The HMI should identify the active device, affected zone, unmet condition, required reset location, and state waiting for a start command. Avoid resetting an entire line from a point where the operator cannot assess all hazardous areas.

16. Prevent unexpected restart when energy returns

ISO 14118 addresses unexpected start-up from electrical, hydraulic, pneumatic, gravitational, elastic, and external energy sources. Test what happens when power returns, a valve regains pressure, the PLC restores retained steps, a network reconnects, a slave device restarts its own sequence, or pressure moves an actuator.

Boot and reconnection logic should establish a known inhibited state, reconcile the machine, and wait for an intentional operating command.

17. An E-stop does not replace lockout/tagout for maintenance

When a person enters a hazardous area, removes a guard, touches a mechanism, clears a jam that may release energy, or repairs electrical, pneumatic, or hydraulic equipment, evaluate energy-isolation requirements. Another person may reset the E-stop; a wiring fault may defeat it; and it may interrupt control energy without physically isolating the source.

Recovery documentation should distinguish operator recovery outside the hazard zone, controlled intervention under a defined procedure, and maintenance requiring isolation and LOTO. One generic reset instruction cannot safely cover all three.

18. Design HMI messages and alarms for recovery

A useful alarm answers what occurred, which safety device and zone are active, what prevents reset, what prevents restart, what the operator may do, and when maintenance is required.

Avoid vague messages such as “Safety error,” “Reset failed,” or an unexplained sensor code. Never display instructions encouraging bypass. Alarm history should preserve timestamps and sequence evidence for diagnosis without retaining a command that could trigger an unintended restart.

19. Validate the recovery sequence

Do not test E-stops only while the machine is idle. Build a matrix covering every device and zone, critical phases such as a robot carrying a part or a vertical axis moving, power and air loss, network loss and reconnection, implausible sensor states, and simultaneous activation of multiple protective devices.

Verify that the stop response matches the design, residual hazards are controlled, release does not restart, reset does not create motion, restart requires a separate command, recovery limits work as intended, unknown states are detected, HMI guidance is correct, and logs are adequate for traceability.

This checklist does not replace formal validation of the safety functions under the applicable standards.

20. Design-review checklist

Risk and energy

[ ] Hazards during stopping and recovery have been assessed.
[ ] The energy map covers electrical, pneumatic, hydraulic, gravitational, elastic, thermal, and process energy.
[ ] Retained energy and intended safe states have feedback or another confirmation method.

State transitions

[ ] Releasing the E-stop, resetting, and restarting are separate actions.
[ ] Reset creates no hazardous motion.
[ ] Restoration of energy does not restart the machine.
[ ] Physical state is reverified rather than inferred from sequence memory.
[ ] An unknown state cannot continue automatically.

Recovery

[ ] Homing has been assessed for each relevant interrupted state.
[ ] Recovery mode has defined authority, limits, and exit criteria.
[ ] Vertical axes, clamps, workpieces, and linked equipment have dedicated sequences where required.
[ ] Recovery cannot become an operating bypass.

Human factors

[ ] The person resetting can assess the relevant zone.
[ ] Zone ownership is explicit.
[ ] The HMI distinguishes conditions preventing reset from those preventing restart.
[ ] Operator recovery and maintenance isolation have a clear boundary.

Validation

[ ] Tests cover multiple phases of the operating cycle.
[ ] Power, air, network, and implausible sensor failures are tested.
[ ] Prevention of unexpected restart is confirmed.
[ ] Documentation and revisions are traceable.

Conclusion

E-stop design does not end when motion stops. A safe system must recover without unexpected start-up, without trusting stale software state, and without overlooking stored energy.

Separate release, reset, and restart. Map energy, reconcile physical state, constrain recovery mode, and validate the sequence at several points in the machine cycle.

Most importantly, reset only restores the ability to prepare for operation. The machine may run again only after a separate intentional command and after every required safety condition, mechanical state, and operating permissive has been confirmed.

Public references

View all MINATA technical articles