Emergency Stop

What an Emergency Stop Is

An emergency stop is a function, realised by one or more devices, whose purpose is to avert or reduce harm to people, machinery, or work in progress once a hazardous event is unfolding. ISO 13850:2015, the international standard for the function, defines it as a function that is intended to avert arising or reduce existing hazards, that is initiated by a single human action, and that overrides all other functions and operations in all modes. The single-action requirement is decisive: the operator must not have to think, navigate a menu, or perform a sequence. One blow on the red button must be enough.

It is important to understand where the e-stop sits in the safety hierarchy. ISO 12100, the parent risk-assessment standard, ranks protective measures as inherently safe design first, then guarding and protective devices, then information for use. An emergency stop is a complementary protective measure that supplements guarding, it is not a primary safeguard and it does not replace fixed guards, movable guards fitted with a safety interlock switch, a safety light curtain, or two-hand controls. A machine that relies on operators reacting fast enough to hit a button has not been made safe, it has merely been given a last line of defence. The emergency stop is that last line.

Three properties separate a true emergency stop from an ordinary stop button. First, it must be continuously available and operational in every operating mode, including setup and maintenance modes, so it cannot be muted by a key switch. Second, it must take priority over all other commands, the running command, the automatic cycle, even a competing stop request. Third, once actuated it must latch in the actuated position and remain latched until a person deliberately resets it, and that reset must not by itself restart the machine. Resetting only removes the inhibit, a separate deliberate action is then required to start. These three properties are what the standards spend most of their text enforcing.

The emergency stop must not be confused with emergency switching off. IEC 60204-1 distinguishes the two. Emergency stop, the subject of this guide, addresses a mechanical or process hazard such as a moving axis, a rotating tool, or a runaway conveyor. Emergency switching off, governed by IEC 60364-4-46 for electrical installations, addresses an electrical hazard such as shock or arc flash by disconnecting the supply. The two devices look identical, red on yellow, but the circuit each commands and the standard each is judged by are different. A machine may need one, the other, or both, and a single device can be assigned both duties where the disconnection it performs also removes the electrical hazard.

The history of the device tracks the industrialisation of machine safety. Manually operated stop levers and trip bars appeared on textile and printing machinery in the nineteenth and early twentieth centuries, long before any standard. The red mushroom pushbutton with mechanical latching became the dominant form in the mid twentieth century. International harmonisation followed: the function was codified in EN 418 in Europe in the 1990s, which was later superseded by EN ISO 13850, while the device requirements were captured in IEC 60947-5-5, the standard for control circuit devices with mechanical latching function. The 2015 revision of ISO 13850 added explicit provisions, allowing a protective shroud or guard ring to prevent unintended actuation and requiring reset-direction arrows to use a low-contrast colour so they cannot be misread as an actuation direction.

Device Families and Actuator Types

ISO 13850 permits several actuator forms, and the right one depends on the geometry of the hazard and the reach of the operator. Clause 4.4 of the standard lists pushbuttons, wires or ropes or bars, and foot pedals without a protective cover as acceptable actuator types. The choice is not cosmetic: a point hazard at an operator station is well served by a mushroom button, but a hazard distributed along the length of a conveyor demands a rope that the worker can grab anywhere. The table below summarises the main families and their typical use.

The mushroom pushbutton is the default and by far the most common form. It uses a 22 mm panel cut-out with a red mushroom head, most often 40 mm in diameter, mounted on a contact block carrying one to four normally closed safety contacts and frequently a normally open monitoring contact. The head latches down when struck and is released by twisting, pulling, or, where deliberate restriction is wanted, turning a key. ISO 13850 actually discourages devices that require a key to disengage, because a missing key can leave a machine stopped or, worse, tempt an operator to defeat the device. Hand-operated actuators should be mounted between 0.6 m and 1.7 m above the access level so they fall naturally to hand.

The palm or large-head button is a mushroom variant with an oversized striking surface, used where the operator may need to hit the device with a forearm or while looking elsewhere, such as on power presses and brake presses. Its electrical behaviour is identical to the mushroom, the difference is purely ergonomic target size.

The rope or cable pull switch turns a length of red PVC-coated steel rope, typically around 3 mm to 5 mm in diameter, into one continuous actuator. Pulling the rope anywhere along its run, or a break or slackening of the rope, opens the safety contacts. A single switch commonly covers a rope span up to about 75 m pulled from one end, and a two-end installation with a switch at each end of the run extends the protected length to roughly 125 m on heavy-duty series such as the Allen-Bradley Lifeline 4. A tension indicator window shows the rope is correctly pre-tensioned, because a sagging rope is both a tripping nuisance and a sign the break-detection geometry has drifted. Like a mushroom device the switch latches and must be manually reset at the unit.

Trip bars and foot pedals cover the remaining cases. A trip bar gives a long, easy-to-strike actuator across the front of a machine with an exposed nip, such as a roll feed or a calender, while a rope pull is the usual choice running alongside a belt conveyor. A foot pedal e-stop, which ISO 13850 permits only without a protective cover so it cannot be confused with an operating pedal, suits work where both hands are committed to the task. In every case the same three rules apply: single action, priority over all other functions, and latch until deliberate reset.

Working Principle: Direct Opening and Self-Monitoring

What makes an emergency stop device trustworthy is not the red colour, it is the mechanics of how the contacts open and how a failed device is detected. Two concepts dominate: direct opening action, also called positive break or positive opening, and contact-block self-monitoring. Both exist to defeat the failure mode that would otherwise be catastrophic, a contact that has welded shut and silently does nothing when the button is pressed.

Direct opening action is defined in IEC 60947-5-1 Annex K and required for emergency stop devices by IEC 60947-5-5. It means the normally closed safety contacts are forced apart by a rigid, non-resilient mechanical member that moves with the actuator, not by a return spring. In a normal switch a spring pushes the contacts open, and if the contacts have welded, the spring simply cannot overcome the weld and the circuit stays closed. With direct opening action the actuator travel mechanically tears welded contacts apart through metal, not through a spring. Devices that provide it are marked with the arrow-in-circle positive-opening symbol and carry the IEC 60417-5638 emergency stop symbol. This is mandatory for the safety contacts of any compliant e-stop, ordinary signalling contacts do not need it.

Self-monitoring of the contact block addresses a different failure, the contact block working loose or falling off the back of the actuator. A self-monitoring device adds a spring-loaded normally open monitoring contact between the operator and the contact block. If the block separates from the operator, that monitoring contact, which is held closed only by the block being seated, opens and signals the loss to the safety circuit. Schneider Electric, EAO, IDEC, and others offer this as their self-monitoring or safe-break feature. The combination of forced opening on the safety contacts and a held-by-seating monitoring contact means both a welded contact and a detached block are revealed.

Latching and reset is the third mechanical pillar. Per IEC 60947-5-5 the device has a mechanical latching function: when struck, the actuator stays in the actuated position until deliberately released. The release motion, twist, pull, or key, only re-arms the device. ISO 13850 is explicit that resetting the actuator must not by itself restart the machine, it must only permit a restart by a separate, deliberate command. This is enforced in the wiring: the e-stop contacts feed a safety relay or safety controller, which after the latch is cleared still requires a distinct reset input and then a separate start before hazardous motion can resume. The table below compares the principles used in the main device categories.

It is worth stressing that ISO 13850 forbids placing programmable logic in the trip path for low-complexity e-stops unless it is rated safety logic. The standard and IEC 60204-1 require the emergency stop to act through electromechanical components or a certified safety controller, not through an ordinary PLC running standard application code. A standard PLC can monitor the e-stop and report its state to an operator interface, but it must never be the only thing standing between the button and the removal of power.

Stop Categories and Functional Safety

Choosing the device is only half the job. The other half is deciding how the machine reacts when the device is pressed, and how reliable that reaction must be. The first question is the stop category, the second is the functional safety target. Both are governed by their own standards, and both flow from the machine risk assessment, not from preference.

IEC 60204-1 defines three stop categories. Only the first two are permitted to realise an emergency stop, because the third does not remove energy.

• Category 0: stopping by immediate removal of power to the machine actuators, an uncontrolled stop. A contactor or safety relay drops out and the motor coasts to rest. This is the simplest and most fail-safe arrangement because the safe state is the de-energised state.
• Category 1: a controlled stop in which power is kept available to the actuators to achieve the stop, for example to brake a drive, and then power is removed once standstill is reached. This is used where coasting is more dangerous than a controlled brake, such as a high-inertia spindle that must be brought down quickly.
• Category 2: a controlled stop with power retained at standstill. This is a normal operational stop and is not permitted for emergency stop, because energy remains present.

The decision between category 0 and category 1 is an engineering trade-off. Category 0 gives the most reliable removal of energy but the longest coast-down for high-inertia loads, which can mean a longer travel into a hazard. Category 1 gives the shortest stopping distance through active braking but depends on the brake function working before power is cut, so it carries more to verify. Many modern motor drives, such as a variable frequency drive, implement a Safe Torque Off and a Safe Stop 1 function exactly to support these categories with built-in monitoring.

The second axis is functional safety, the quantified reliability of the stopping function. Two standards apply. ISO 13849-1 expresses the result as a Performance Level from PLa to PLe, built on an architecture Category from B to 4. IEC 62061 expresses the equivalent as a Safety Integrity Level, SIL 1 to SIL 3. The two scales correspond: PLc is broadly equivalent to SIL 1, PLd to SIL 2, and PLe to SIL 3. ISO 13850 treats the emergency stop function as a minimum of PLc, or SIL 1, but the actual requirement is set by the machine risk assessment and is frequently higher. The table below maps the architecture, the achievable performance, and the typical e-stop use.

For the device itself, the relevant reliability figure is the B10d value, the number of operations at which 10 percent of a sample have failed to danger. A mechanical e-stop with direct opening action typically carries a high B10d, often in the range of millions of operations, because the dominant failure mode is mechanical wear of the contacts. To reach PLd or PLe, designers combine the device B10d with a dual-channel architecture and diagnostic coverage from a safety relay or safety controller that cross-monitors the two channels and detects a single fault before the next demand. The red button does not set the performance level on its own, the whole channel from button to final element does.

Regional rules add a layer on top. In North America, NFPA 79 mirrors IEC 60204-1 for industrial machinery and likewise restricts emergency stop to stop categories 0 and 1, while OSHA references it for workplace machine safety. In the European Union the Machinery Directive, now the Machinery Regulation, makes the harmonised standards the practical route to conformity. A machine sold across regions must satisfy the strictest applicable set, which usually means designing to ISO 13850 and IEC 60204-1 and confirming NFPA 79 alignment.

Key Specification Parameters

A device datasheet for an emergency stop can list two or three dozen lines, but only a handful drive a sound selection. The parameters below are the ones a controls or procurement engineer should compare across candidate catalogue numbers before committing. They split into the safety-critical group, which standards mandate, and the application group, which the installation environment dictates.

Contact configuration is the first line to check. Safety contacts are normally closed and must have direct opening action, listed as NC with the positive-opening symbol. A typical e-stop offers one to four NC safety contacts plus, on self-monitoring variants, one NO monitoring contact, written as a configuration such as 2NC, 3NC 1NO, or 1NO 2NC. For a dual-channel PLd or PLe circuit you need at least two independent NC contacts so the two channels are electrically separate.

Utilization category and rating describe what the contacts can actually switch. Control circuit devices use the AC-15 and DC-13 utilization categories of IEC 60947-5-1, which cover the inductive loads of contactor coils and solenoids. A common rating is AC-15 6 A at 230 V, with DC-13 figures such as around 0.55 A at 125 V DC and 0.27 A at 250 V DC. Picking a contact whose AC-15 or DC-13 rating exceeds the coil it drives is what prevents contact erosion and eventual welding.

Ingress protection and mechanical robustness determine survival in the real environment. Panel cut-out is almost universally 22 mm. Sealed actuators commonly reach IP66, IP67, and IP69K from the front, with IP69K signifying resistance to high-pressure, high-temperature washdown for food and beverage lines. North American enclosure equivalents are NEMA Type 4 and 4X. Impact resistance is rated by an IK code, and operating temperature is typically specified from about minus 25 degrees C to plus 70 degrees C for industrial-grade devices.

Color, marking, and ergonomics are not optional cosmetics, they are requirements. The actuator must be red, the immediate background yellow, the head size commonly 30 mm or 40 mm, and the only permitted symbol is the IEC 60417-5638 emergency stop symbol. Reset arrows must be low-contrast against the actuator. Mounting height for hand-operated devices is 0.6 m to 1.7 m above the access level. The table below lists the parameters and the typical or standard-mandated values to compare.

For rope pull devices, add three parameters: maximum rope span per switch, often up to about 75 m from one end and up to roughly 125 m for a two-end span on heavy-duty series, rope diameter, typically 3 mm to 5 mm PVC-coated steel, and the presence of a rope tension indicator that confirms correct pre-tension and break-detection geometry. A rope device must trip on both an excess pull and a slack or broken rope, and like every e-stop it must latch until manually reset at the switch.

Selection Decision Factors

To turn the preceding chapters into a specific catalogue number, follow the decision sequence below. Most emergency stop mistakes are not a single wrong line on the datasheet, they are a decision taken at the wrong level: choosing the device before the stop category, or the contact rating before the performance level. These steps can serve as a fixed specification template for an RFQ.

1. Hazard geometry and actuator type: first decide whether the hazard is at a point, served by a mushroom or palm button at the operator station, or distributed along a length, served by a rope pull or trip bar. Place a device at every operator control station and wherever a worker could be when the hazard arises.
2. Stop category: decide category 0, immediate removal of power and coast-down, or category 1, controlled brake then power removal. Base this on which gives the shorter, safer stopping distance for the actual inertia, never on habit. Category 2 is not permitted.
3. Performance level or SIL: derive PLr from the ISO 13849-1 risk graph or the SIL from IEC 62061. Treat PLc or SIL 1 as a floor, then size the architecture, single channel, Category 2, or dual channel Category 3 or 4, to meet the assessed target.
4. Contact configuration: select enough NC direct-opening safety contacts for the architecture, two independent NC for dual channel, plus a NO monitoring contact if contact-block self-monitoring is wanted. Confirm the positive-opening symbol on the datasheet.
5. Contact rating against load: match the AC-15 or DC-13 rating to the coil or input it drives, for example AC-15 6 A 230 V for a contactor coil, so the contact never erodes toward a weld.
6. Environment and ingress protection: choose IP65 or IP66 for general industry, IP69K and NEMA 4X for washdown and food lines, and confirm the operating temperature range and IK impact rating for the location.
7. Reset and accessibility: choose twist, pull, or key release, prefer twist or pull because ISO 13850 discourages key-disengage devices, and mount hand-operated actuators 0.6 m to 1.7 m above the access level with the red-on-yellow contrast preserved.
8. Wiring and span of control: decide which devices are grouped into one safety zone. ISO 13850 requires the operator to be able to identify which device acts on which part of the machine, so a large machine is split into clearly labelled emergency stop zones rather than one circuit for everything.

A frequently overlooked dimension is serviceability and certification traceability. Emergency stop devices are safety components, so the catalogue number on the line must match a current datasheet with the IEC 60947-5-5 declaration, and replacements over the machine life must be like-for-like to preserve the certified performance level. Mainstream series with broad availability and documented compliance include Schneider Electric Harmony XB4 and XB5, Allen-Bradley 800F and 800T, Siemens SIRIUS ACT 3SU1, Eaton M22, ABB Modular, Lovato 8LM, Omron A22E, and IDEC HA and X6, with EUCHNER RPS, Pilz PIT, and Allen-Bradley Lifeline 440E covering rope pull duty. Confirm the contact configuration, IP rating, and certification on the manufacturer datasheet before purchase, never from a distributor summary alone.