Emergency stop (E-stop) and emergency hold are not interchangeable safety functions: the first removes hazardous motion by opening a hardwired safety circuit and demands a deliberate manual reset, the second latches servo enable while the drive bus stays live, so the axis holds position under closed-loop torque control [S2][S7].
Engineers specifying machine guarding tend to confuse the two because both are triggered by a red button, but the underlying standard, contact topology, and restart sequence are different. A wrong substitution will either fail the emergency stop button conformity check or remove holding torque at the worst possible moment.
Stop Categories 0, 1, and 2: the ISO 13850 Framework
ISO 13850 defines three stop categories, and the choice of category is what separates an E-stop from a controlled hold [S2]. Stop category 0 is an uncontrolled hard cut: the contactor drops, the motor is disconnected from mains, and the assembly coasts to rest or is caught by a mechanical brake. Stop category 1, the classic E-stop, is a controlled stop with power retained during braking, followed by power removal once zero speed is detected. Stop category 2 keeps power on continuously and uses the drive to bring the axis to a stop, then holds position; this is the "emergency hold" path. The standard is explicit: stop category 2 "may not be used to switch off machines or plants in case of danger" [S2].
That last clause is the line that trips most retrofit projects. A hold-to-stop is acceptable for a controlled interruption during a process upset (a misfeed, a label jam, a vision system reject), but it is not a safety function in the sense of ISO 13850. The functional-safety chain (category, PL, or SIL) has to sit on category 0 or 1 hardware if human injury is the hazard being mitigated [S2].
Contact Topology: NC vs NO, Direct Opening, and Self-Holding
An emergency stop actuator is wired through normally closed (NC) contacts with a direct opening mechanism, so any mechanical failure of the contact block opens the safety circuit the same way a human press does [S3]. A regular pushbutton, by contrast, is normally open (NO) and completes a control circuit only while held; releasing it returns the circuit to its resting state. Three other construction rules are mandated on the E-stop side: a mushroom-head or equivalent palm actuator, a self-holding (latching) function so the button stays engaged after release, and a twist or key reset that forces the operator to acknowledge the fault before re-energising [S3][S7].
That reset step is what gives an E-stop its diagnostic value. Because the latched contact cannot be reclosed by simply removing the hazard, the controller can be wired to require a separate reset command, which forces the safety relay or safety PLC to revalidate guard doors, light curtains, and standstill before allowing a restart. A hold function implemented purely in software has no equivalent mechanical witness; a stuck-low I/O or a firmware bug can silently release the axis.
Power State After Trigger: Removed, Retained, or Actively Held
The cleanest decision criterion is what happens to the drive bus the instant the button is hit [S2][S5]. E-stop category 0: the contactor opens, the DC bus decays through the regen or brake resistor, and the motor produces no torque. E-stop category 1: the drive is given a controlled ramp, the brake output is enabled, and only after zero-speed feedback does the line contactor drop. Emergency hold: the bus stays at full voltage, the drive remains in closed-loop current or position mode, and the only thing that changes is the velocity command, which is latched to zero. Galco's safety write-up summarises the split: E-stops are for "stop equipment quickly during unsafe operating conditions," while disconnects are for isolating energy so maintenance can proceed [S5].
The trade-off is failure mode. Category 0 leaves the load to gravity, springs, and friction, which is fine for a conveyor but unacceptable for a vertical axis where a hanging mass will drift. Category 1 is the typical compromise for vertical axes when paired with a separately certified mechanical brake. Hold is appropriate when the process value matters more than the energy state, for example a winding tension loop or a syringe pump that must not lose position reference mid-cycle.
Use-Case Split: When E-Stop Is the Right Call and When Hold Wins
Use a hardwired E-stop when the hazard is to a person: a robot cell, a press brake, a conveyor with nip points, a packaging line with reciprocating blades. Use a software hold when the hazard is to the product, the tool, or process continuity: a CNC tool change interrupted by a sensor fault, a labelling head that must not lose registration, a steriliser that must complete its dwell time even if an operator opens a light curtain. Siemens forum contributors have a working rule of thumb: a "section stop" is wired through a normal stop relay and only kills the affected station, while the emergency stop drops every energy-isolating contactor on the line [S1][S6].
Schlegel's reference example is concrete: a robot E-stop keeps the 24 V control and diagnostic rails alive so engineers can read the fault code, which is why category 1 is "typical for emergency-stop buttons" [S2]. A conveyor collision, in the same reference, calls for an emergency switch-off that drops the supply entirely, because the hazard is electrical, not mechanical [S2]. The choice is not philosophy; it is dictated by whether the post-event state needs power.
Standards, Wiring, and What Auditors Will Check
Three documents govern the E-stop side of the design: ISO 13850 (the stop categories and the red mushroom on yellow background), IEC 60204-1 (the electrical equipment of machines, section 9.2 covers emergency stop), and the EU Machinery Regulation 2006/42/EC for CE-marked equipment [S2]. For the hold side, IEC 61800-5-2 defines the Safe Torque Off (STO), Safe Stop 1 (SS1), and Safe Stop 2 (SS2) functions, where SS2 is the standardised equivalent of "emergency hold." An emergency rescue plan, where someone has to enter a guarded cell with power on, is the most common reason to have both functions on the same machine: SS2 for the controlled entry, E-stop category 0 or 1 for the unconditional abort.
Field wiring errors cluster around three patterns. First, mixing NC and NO contacts on a single safety relay channel; the relay will pass the cross-fault check but the contactor will not drop on a stuck-closed NO. Second, using a single-channel hold line on a vertical axis without a second enable path; a broken wire then looks identical to a healthy stop. Third, resetting the E-stop from a software HMI button rather than the physical twist-to-release; this defeats the manual-reset requirement that makes the E-stop diagnostic [S7].
Decision Matrix: Picking the Right Function for the Hazard
For a hands-off comparison, the four criteria that matter are energy state after trigger, reset mechanism, governing standard, and suitable application envelope [S2][S5][S7]. Stop category 0 removes all energy, requires a manual twist or key reset, falls under ISO 13850, and fits any hazard where coast-down is acceptable. Stop category 1 removes energy after a controlled ramp, also requires a manual reset under ISO 13850, and fits vertical axes or high-inertia loads that need a brake ramp. Stop category 2 / SS2 / hold keeps the bus energised and the drive in closed-loop control, uses a software reset gated by the safety PLC, and fits process-protection use cases where dropping power would create a worse failure than the trigger event itself. Emergency switch-off (ISO 13850 referenced in DIN EN 60204) is a separate hardware path for electrical hazards such as arc flash or insulation breakdown, and it removes energy even if the drive side is healthy [S2].
The two functions also fail differently. An E-stop failure is loud: the contactor will not pick up, the safety relay will not clear, and the line stays dark until a technician resolves the cause. A hold failure is silent: the drive looks healthy, the position loop is intact, but a desync of the enable line or a firmware exception can release the axis without any visible change to the HMI. That asymmetry is why auditors treat hold as a complementary function, never as a substitute, and why hardwired E-stop circuits remain mandatory on every machine that ships into the EU under the 2006/42/EC framework [S2].
Two signals to track over the next quarter: the revision status of IEC 60204-1 clause 9.2, which several working groups have flagged for clarification on category 1 timing, and the rollout of integrated safety-drive modules that expose SS2 as a discrete STO variant, reducing the wiring count of a combined E-stop plus hold system.
For related coverage, see A380 vs A356 aluminum casting alloy pricing in 2026: drivers, divergence, and sourcing.